Analysis
-
max time kernel
143s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
fd27da88_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
fd27da88_by_Libranalysis.exe
Resource
win10v20210410
General
-
Target
fd27da88_by_Libranalysis.exe
-
Size
1.8MB
-
MD5
fd27da880372209151379289b0e57d11
-
SHA1
9d9236804d7a0574ebff234bec1bea519497c27f
-
SHA256
9a825ee20f777192913e6c02d8038cdb34907bbcfdec074f664516668f7d1339
-
SHA512
d69b43d30cefdf0255c96763f1e53469ff3c0b1dada711b606959616e7af0608fd4cdc6e4b86b2cf174fb856e6ab01f089d6bf295217f6966c8b2576b34c338d
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 64 IoCs
Processes:
resource yara_rule \Windows\system\explorer.exe warzonerat \Windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat \??\c:\windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Temp\Disk.sys warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1680 explorer.exe 572 explorer.exe 524 spoolsv.exe 1172 spoolsv.exe 744 spoolsv.exe 1108 spoolsv.exe 1392 spoolsv.exe 1624 spoolsv.exe 1140 spoolsv.exe 1596 spoolsv.exe 1672 spoolsv.exe 1944 spoolsv.exe 1008 spoolsv.exe 824 spoolsv.exe 1208 spoolsv.exe 1964 spoolsv.exe 1920 spoolsv.exe 2012 spoolsv.exe 1536 spoolsv.exe 1680 spoolsv.exe 1032 spoolsv.exe 1924 spoolsv.exe 1212 spoolsv.exe 896 spoolsv.exe 1092 spoolsv.exe 1300 spoolsv.exe 1316 spoolsv.exe 1716 spoolsv.exe 1404 spoolsv.exe 1976 spoolsv.exe 800 spoolsv.exe 968 spoolsv.exe 1164 spoolsv.exe 1704 spoolsv.exe 1496 spoolsv.exe 644 spoolsv.exe 1952 spoolsv.exe 1560 spoolsv.exe 2024 spoolsv.exe 1772 spoolsv.exe 2032 spoolsv.exe 2028 spoolsv.exe 1064 spoolsv.exe 568 spoolsv.exe 532 spoolsv.exe 1804 spoolsv.exe 1628 spoolsv.exe 1124 spoolsv.exe 1364 spoolsv.exe 1764 spoolsv.exe 1684 spoolsv.exe 836 spoolsv.exe 1472 spoolsv.exe 1940 spoolsv.exe 1388 spoolsv.exe 1280 spoolsv.exe 340 spoolsv.exe 748 spoolsv.exe 832 spoolsv.exe 1252 spoolsv.exe 652 spoolsv.exe 1668 spoolsv.exe 1724 spoolsv.exe 956 spoolsv.exe -
Modifies Installed Components in the registry 2 TTPs
-
Loads dropped DLL 64 IoCs
Processes:
fd27da88_by_Libranalysis.exeexplorer.exepid process 292 fd27da88_by_Libranalysis.exe 292 fd27da88_by_Libranalysis.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe -
Adds Run key to start application 2 TTPs 32 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exefd27da88_by_Libranalysis.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" fd27da88_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 59 IoCs
Processes:
fd27da88_by_Libranalysis.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1904 set thread context of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 set thread context of 1708 1904 fd27da88_by_Libranalysis.exe diskperf.exe PID 1680 set thread context of 572 1680 explorer.exe explorer.exe PID 1680 set thread context of 828 1680 explorer.exe diskperf.exe PID 524 set thread context of 3080 524 spoolsv.exe spoolsv.exe PID 524 set thread context of 3088 524 spoolsv.exe diskperf.exe PID 1172 set thread context of 3128 1172 spoolsv.exe spoolsv.exe PID 1172 set thread context of 3136 1172 spoolsv.exe diskperf.exe PID 744 set thread context of 3164 744 spoolsv.exe spoolsv.exe PID 744 set thread context of 3172 744 spoolsv.exe diskperf.exe PID 1108 set thread context of 3200 1108 spoolsv.exe spoolsv.exe PID 1108 set thread context of 3208 1108 spoolsv.exe diskperf.exe PID 1392 set thread context of 3236 1392 spoolsv.exe spoolsv.exe PID 1392 set thread context of 3244 1392 spoolsv.exe diskperf.exe PID 1624 set thread context of 3268 1624 spoolsv.exe spoolsv.exe PID 1624 set thread context of 3276 1624 spoolsv.exe diskperf.exe PID 1140 set thread context of 3304 1140 spoolsv.exe spoolsv.exe PID 1140 set thread context of 3312 1140 spoolsv.exe diskperf.exe PID 1596 set thread context of 3332 1596 spoolsv.exe spoolsv.exe PID 1596 set thread context of 3340 1596 spoolsv.exe diskperf.exe PID 1672 set thread context of 3352 1672 spoolsv.exe spoolsv.exe PID 1672 set thread context of 3360 1672 spoolsv.exe diskperf.exe PID 1944 set thread context of 3384 1944 spoolsv.exe spoolsv.exe PID 1944 set thread context of 3392 1944 spoolsv.exe diskperf.exe PID 1008 set thread context of 3416 1008 spoolsv.exe spoolsv.exe PID 1008 set thread context of 3424 1008 spoolsv.exe diskperf.exe PID 824 set thread context of 3448 824 spoolsv.exe spoolsv.exe PID 824 set thread context of 3456 824 spoolsv.exe diskperf.exe PID 1208 set thread context of 3484 1208 spoolsv.exe spoolsv.exe PID 1208 set thread context of 3492 1208 spoolsv.exe diskperf.exe PID 1964 set thread context of 3516 1964 spoolsv.exe spoolsv.exe PID 1964 set thread context of 3524 1964 spoolsv.exe diskperf.exe PID 1920 set thread context of 3552 1920 spoolsv.exe spoolsv.exe PID 1920 set thread context of 3560 1920 spoolsv.exe diskperf.exe PID 2012 set thread context of 3588 2012 spoolsv.exe spoolsv.exe PID 2012 set thread context of 3596 2012 spoolsv.exe diskperf.exe PID 1536 set thread context of 3620 1536 spoolsv.exe spoolsv.exe PID 1536 set thread context of 3640 1536 spoolsv.exe diskperf.exe PID 1680 set thread context of 3648 1680 spoolsv.exe spoolsv.exe PID 1680 set thread context of 3656 1680 spoolsv.exe diskperf.exe PID 1032 set thread context of 3680 1032 spoolsv.exe spoolsv.exe PID 1032 set thread context of 3700 1032 spoolsv.exe diskperf.exe PID 1924 set thread context of 3712 1924 spoolsv.exe spoolsv.exe PID 1924 set thread context of 3720 1924 spoolsv.exe diskperf.exe PID 1212 set thread context of 3740 1212 spoolsv.exe spoolsv.exe PID 1212 set thread context of 3748 1212 spoolsv.exe diskperf.exe PID 896 set thread context of 3768 896 spoolsv.exe spoolsv.exe PID 896 set thread context of 3776 896 spoolsv.exe diskperf.exe PID 1092 set thread context of 3796 1092 spoolsv.exe spoolsv.exe PID 1092 set thread context of 3808 1092 spoolsv.exe diskperf.exe PID 1300 set thread context of 3820 1300 spoolsv.exe spoolsv.exe PID 1300 set thread context of 3828 1300 spoolsv.exe diskperf.exe PID 1316 set thread context of 3848 1316 spoolsv.exe spoolsv.exe PID 1316 set thread context of 3856 1316 spoolsv.exe diskperf.exe PID 1716 set thread context of 3864 1716 spoolsv.exe spoolsv.exe PID 1716 set thread context of 3872 1716 spoolsv.exe diskperf.exe PID 1976 set thread context of 3892 1976 spoolsv.exe spoolsv.exe PID 1976 set thread context of 3912 1976 spoolsv.exe diskperf.exe PID 1404 set thread context of 3920 1404 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
fd27da88_by_Libranalysis.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe fd27da88_by_Libranalysis.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fd27da88_by_Libranalysis.exeexplorer.exepid process 292 fd27da88_by_Libranalysis.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 572 explorer.exe -
Suspicious use of SetWindowsHookEx 60 IoCs
Processes:
fd27da88_by_Libranalysis.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 292 fd27da88_by_Libranalysis.exe 292 fd27da88_by_Libranalysis.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 3080 spoolsv.exe 3080 spoolsv.exe 3128 spoolsv.exe 3128 spoolsv.exe 3164 spoolsv.exe 3164 spoolsv.exe 3200 spoolsv.exe 3200 spoolsv.exe 3236 spoolsv.exe 3236 spoolsv.exe 3268 spoolsv.exe 3268 spoolsv.exe 3304 spoolsv.exe 3304 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 3352 spoolsv.exe 3352 spoolsv.exe 3384 spoolsv.exe 3384 spoolsv.exe 3416 spoolsv.exe 3416 spoolsv.exe 3448 spoolsv.exe 3448 spoolsv.exe 3484 spoolsv.exe 3484 spoolsv.exe 3516 spoolsv.exe 3516 spoolsv.exe 3552 spoolsv.exe 3552 spoolsv.exe 3588 spoolsv.exe 3588 spoolsv.exe 3620 spoolsv.exe 3620 spoolsv.exe 3648 spoolsv.exe 3648 spoolsv.exe 3680 spoolsv.exe 3680 spoolsv.exe 3712 spoolsv.exe 3712 spoolsv.exe 3740 spoolsv.exe 3740 spoolsv.exe 3768 spoolsv.exe 3768 spoolsv.exe 3796 spoolsv.exe 3796 spoolsv.exe 3820 spoolsv.exe 3820 spoolsv.exe 3864 spoolsv.exe 3864 spoolsv.exe 3848 spoolsv.exe 3848 spoolsv.exe 3892 spoolsv.exe 3892 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd27da88_by_Libranalysis.exefd27da88_by_Libranalysis.exeexplorer.exeexplorer.exedescription pid process target process PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 292 1904 fd27da88_by_Libranalysis.exe fd27da88_by_Libranalysis.exe PID 1904 wrote to memory of 1708 1904 fd27da88_by_Libranalysis.exe diskperf.exe PID 1904 wrote to memory of 1708 1904 fd27da88_by_Libranalysis.exe diskperf.exe PID 1904 wrote to memory of 1708 1904 fd27da88_by_Libranalysis.exe diskperf.exe PID 1904 wrote to memory of 1708 1904 fd27da88_by_Libranalysis.exe diskperf.exe PID 1904 wrote to memory of 1708 1904 fd27da88_by_Libranalysis.exe diskperf.exe PID 1904 wrote to memory of 1708 1904 fd27da88_by_Libranalysis.exe diskperf.exe PID 292 wrote to memory of 1680 292 fd27da88_by_Libranalysis.exe explorer.exe PID 292 wrote to memory of 1680 292 fd27da88_by_Libranalysis.exe explorer.exe PID 292 wrote to memory of 1680 292 fd27da88_by_Libranalysis.exe explorer.exe PID 292 wrote to memory of 1680 292 fd27da88_by_Libranalysis.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 572 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 828 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 828 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 828 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 828 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 828 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 828 1680 explorer.exe diskperf.exe PID 572 wrote to memory of 524 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 524 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 524 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 524 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1172 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1172 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1172 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1172 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 744 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 744 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 744 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 744 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1108 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1108 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1108 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1108 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1392 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1392 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1392 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1392 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1624 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1624 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1624 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1624 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1140 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1140 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1140 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1140 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1596 572 explorer.exe spoolsv.exe PID 572 wrote to memory of 1596 572 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd27da88_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\fd27da88_by_Libranalysis.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd27da88_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\fd27da88_by_Libranalysis.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeMD5
fd27da880372209151379289b0e57d11
SHA19d9236804d7a0574ebff234bec1bea519497c27f
SHA2569a825ee20f777192913e6c02d8038cdb34907bbcfdec074f664516668f7d1339
SHA512d69b43d30cefdf0255c96763f1e53469ff3c0b1dada711b606959616e7af0608fd4cdc6e4b86b2cf174fb856e6ab01f089d6bf295217f6966c8b2576b34c338d
-
C:\Users\Admin\AppData\Local\Temp\Disk.sysMD5
7592e955470f7e34b4855390baa21deb
SHA13526d7d2365ca81b2c6fe41908c172d92dd138b1
SHA256d85b0df1faeb6279790355633b18c8f2e2d2d3577ad67d773b0e8fe1b7ff11c1
SHA5129b7c3512668fcea9e936a2991ff996b07f1ab866a274c7652637e4dc07e56b7e5bb5154d33b932d47131763cf6b59b937222222fcdb4341e8d6796e067dcf4ea
-
C:\Windows\system\explorer.exeMD5
7592e955470f7e34b4855390baa21deb
SHA13526d7d2365ca81b2c6fe41908c172d92dd138b1
SHA256d85b0df1faeb6279790355633b18c8f2e2d2d3577ad67d773b0e8fe1b7ff11c1
SHA5129b7c3512668fcea9e936a2991ff996b07f1ab866a274c7652637e4dc07e56b7e5bb5154d33b932d47131763cf6b59b937222222fcdb4341e8d6796e067dcf4ea
-
C:\Windows\system\explorer.exeMD5
7592e955470f7e34b4855390baa21deb
SHA13526d7d2365ca81b2c6fe41908c172d92dd138b1
SHA256d85b0df1faeb6279790355633b18c8f2e2d2d3577ad67d773b0e8fe1b7ff11c1
SHA5129b7c3512668fcea9e936a2991ff996b07f1ab866a274c7652637e4dc07e56b7e5bb5154d33b932d47131763cf6b59b937222222fcdb4341e8d6796e067dcf4ea
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
C:\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\??\c:\windows\system\explorer.exeMD5
7592e955470f7e34b4855390baa21deb
SHA13526d7d2365ca81b2c6fe41908c172d92dd138b1
SHA256d85b0df1faeb6279790355633b18c8f2e2d2d3577ad67d773b0e8fe1b7ff11c1
SHA5129b7c3512668fcea9e936a2991ff996b07f1ab866a274c7652637e4dc07e56b7e5bb5154d33b932d47131763cf6b59b937222222fcdb4341e8d6796e067dcf4ea
-
\Windows\system\explorer.exeMD5
7592e955470f7e34b4855390baa21deb
SHA13526d7d2365ca81b2c6fe41908c172d92dd138b1
SHA256d85b0df1faeb6279790355633b18c8f2e2d2d3577ad67d773b0e8fe1b7ff11c1
SHA5129b7c3512668fcea9e936a2991ff996b07f1ab866a274c7652637e4dc07e56b7e5bb5154d33b932d47131763cf6b59b937222222fcdb4341e8d6796e067dcf4ea
-
\Windows\system\explorer.exeMD5
7592e955470f7e34b4855390baa21deb
SHA13526d7d2365ca81b2c6fe41908c172d92dd138b1
SHA256d85b0df1faeb6279790355633b18c8f2e2d2d3577ad67d773b0e8fe1b7ff11c1
SHA5129b7c3512668fcea9e936a2991ff996b07f1ab866a274c7652637e4dc07e56b7e5bb5154d33b932d47131763cf6b59b937222222fcdb4341e8d6796e067dcf4ea
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
\Windows\system\spoolsv.exeMD5
d98a1ffbcba4c62c682d7376e65d6d0b
SHA132d51f5afd62e9a9774487f63030e959fa1bb063
SHA256686dc55dcc3b48847f6685b710426750e52ae68440dc7f0b424cf04cbe1e0c78
SHA51239be98ab803b26517c6a32d94c36e2ea98727a9af139e87d3c100f5314b68f48ecf83e3e5599dba9139ad62a5d25dca4b74bc0e7f0f9e09876d48c46f2d4569e
-
memory/292-61-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/292-62-0x0000000000403670-mapping.dmp
-
memory/292-75-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/340-305-0x0000000000000000-mapping.dmp
-
memory/524-95-0x0000000000000000-mapping.dmp
-
memory/524-103-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/532-286-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/532-274-0x0000000000000000-mapping.dmp
-
memory/568-272-0x0000000000000000-mapping.dmp
-
memory/568-285-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/572-80-0x0000000000403670-mapping.dmp
-
memory/644-244-0x0000000000000000-mapping.dmp
-
memory/644-251-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/652-309-0x0000000000000000-mapping.dmp
-
memory/744-115-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/744-107-0x0000000000000000-mapping.dmp
-
memory/748-312-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/748-306-0x0000000000000000-mapping.dmp
-
memory/800-234-0x0000000000000000-mapping.dmp
-
memory/800-246-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/824-170-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/824-161-0x0000000000000000-mapping.dmp
-
memory/828-86-0x0000000000411000-mapping.dmp
-
memory/832-313-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/832-307-0x0000000000000000-mapping.dmp
-
memory/836-300-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/836-294-0x0000000000000000-mapping.dmp
-
memory/896-211-0x0000000000000000-mapping.dmp
-
memory/968-236-0x0000000000000000-mapping.dmp
-
memory/1008-158-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1008-154-0x0000000000000000-mapping.dmp
-
memory/1032-210-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1032-203-0x0000000000000000-mapping.dmp
-
memory/1064-284-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1064-269-0x0000000000000000-mapping.dmp
-
memory/1092-228-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1092-215-0x0000000000000000-mapping.dmp
-
memory/1108-112-0x0000000000000000-mapping.dmp
-
memory/1108-116-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1124-280-0x0000000000000000-mapping.dmp
-
memory/1124-289-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1140-144-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1140-129-0x0000000000000000-mapping.dmp
-
memory/1164-248-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1164-238-0x0000000000000000-mapping.dmp
-
memory/1172-100-0x0000000000000000-mapping.dmp
-
memory/1172-104-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1208-173-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1208-166-0x0000000000000000-mapping.dmp
-
memory/1212-208-0x0000000000000000-mapping.dmp
-
memory/1212-213-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1252-308-0x0000000000000000-mapping.dmp
-
memory/1280-304-0x0000000000000000-mapping.dmp
-
memory/1300-229-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1300-217-0x0000000000000000-mapping.dmp
-
memory/1316-231-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1316-219-0x0000000000000000-mapping.dmp
-
memory/1364-290-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1364-282-0x0000000000000000-mapping.dmp
-
memory/1388-297-0x0000000000000000-mapping.dmp
-
memory/1392-130-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1392-119-0x0000000000000000-mapping.dmp
-
memory/1404-223-0x0000000000000000-mapping.dmp
-
memory/1472-301-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1472-295-0x0000000000000000-mapping.dmp
-
memory/1496-242-0x0000000000000000-mapping.dmp
-
memory/1536-191-0x0000000000000000-mapping.dmp
-
memory/1536-199-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1560-254-0x0000000000000000-mapping.dmp
-
memory/1560-265-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1596-136-0x0000000000000000-mapping.dmp
-
memory/1596-146-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1624-124-0x0000000000000000-mapping.dmp
-
memory/1624-131-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1628-288-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1628-278-0x0000000000000000-mapping.dmp
-
memory/1672-141-0x0000000000000000-mapping.dmp
-
memory/1672-145-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1680-77-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1680-196-0x0000000000000000-mapping.dmp
-
memory/1680-72-0x0000000000000000-mapping.dmp
-
memory/1680-200-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1684-293-0x0000000000000000-mapping.dmp
-
memory/1684-299-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1704-240-0x0000000000000000-mapping.dmp
-
memory/1704-249-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1708-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1708-66-0x0000000000411000-mapping.dmp
-
memory/1708-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-221-0x0000000000000000-mapping.dmp
-
memory/1764-298-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1764-291-0x0000000000000000-mapping.dmp
-
memory/1772-258-0x0000000000000000-mapping.dmp
-
memory/1804-276-0x0000000000000000-mapping.dmp
-
memory/1904-60-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1904-59-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1920-178-0x0000000000000000-mapping.dmp
-
memory/1924-212-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1924-206-0x0000000000000000-mapping.dmp
-
memory/1940-296-0x0000000000000000-mapping.dmp
-
memory/1944-149-0x0000000000000000-mapping.dmp
-
memory/1944-157-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1952-264-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1952-252-0x0000000000000000-mapping.dmp
-
memory/1964-172-0x0000000000000000-mapping.dmp
-
memory/1976-230-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1976-225-0x0000000000000000-mapping.dmp
-
memory/2012-183-0x0000000000000000-mapping.dmp
-
memory/2024-256-0x0000000000000000-mapping.dmp
-
memory/2024-266-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2028-262-0x0000000000000000-mapping.dmp
-
memory/2028-270-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2032-260-0x0000000000000000-mapping.dmp
-
memory/2032-268-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB