Analysis
-
max time kernel
143s -
max time network
57s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 09:03
Static task
static1
Behavioral task
behavioral1
Sample
b78f5c47_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b78f5c47_by_Libranalysis.exe
Resource
win10v20210408
General
-
Target
b78f5c47_by_Libranalysis.exe
-
Size
1.8MB
-
MD5
b78f5c47acef55129ff8d9862c477dcf
-
SHA1
4c8d602143a1a2fd5201ec4214cee155101e5911
-
SHA256
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1
-
SHA512
d18d7a9999a9f50236efe551667dc9c6e226cfd6151a45d7712d980779599d9f5f81f74d97910b73f907e0ba54a85fb38fb5c489ac3cbbbaf49a39f7be28330e
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 64 IoCs
Processes:
resource yara_rule \Windows\system\explorer.exe warzonerat \Windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat \??\c:\windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Temp\Disk.sys warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1680 explorer.exe 1488 explorer.exe 1356 spoolsv.exe 568 spoolsv.exe 1836 spoolsv.exe 688 spoolsv.exe 1100 spoolsv.exe 1620 spoolsv.exe 1736 spoolsv.exe 1108 spoolsv.exe 816 spoolsv.exe 956 spoolsv.exe 1704 spoolsv.exe 1688 spoolsv.exe 1724 spoolsv.exe 1360 spoolsv.exe 1440 spoolsv.exe 1912 spoolsv.exe 1556 spoolsv.exe 836 spoolsv.exe 1004 spoolsv.exe 524 spoolsv.exe 436 spoolsv.exe 864 spoolsv.exe 608 spoolsv.exe 1092 spoolsv.exe 1316 spoolsv.exe 1248 spoolsv.exe 2040 spoolsv.exe 1260 spoolsv.exe 1392 spoolsv.exe 644 spoolsv.exe 944 spoolsv.exe 900 spoolsv.exe 1164 spoolsv.exe 1676 spoolsv.exe 396 spoolsv.exe 332 spoolsv.exe 1576 spoolsv.exe 1068 spoolsv.exe 1336 spoolsv.exe 1680 spoolsv.exe 1196 spoolsv.exe 948 spoolsv.exe 1172 spoolsv.exe 1252 spoolsv.exe 1668 spoolsv.exe 1848 spoolsv.exe 1528 spoolsv.exe 1380 spoolsv.exe 940 spoolsv.exe 800 spoolsv.exe 1708 spoolsv.exe 1604 spoolsv.exe 1008 spoolsv.exe 1188 spoolsv.exe 1796 spoolsv.exe 1996 spoolsv.exe 572 spoolsv.exe 1504 spoolsv.exe 320 spoolsv.exe 1812 spoolsv.exe 1632 spoolsv.exe 1628 spoolsv.exe -
Modifies Installed Components in the registry 2 TTPs
-
Loads dropped DLL 64 IoCs
Processes:
b78f5c47_by_Libranalysis.exeexplorer.exepid process 1764 b78f5c47_by_Libranalysis.exe 1764 b78f5c47_by_Libranalysis.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe -
Adds Run key to start application 2 TTPs 34 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeb78f5c47_by_Libranalysis.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" b78f5c47_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 62 IoCs
Processes:
b78f5c47_by_Libranalysis.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1420 set thread context of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 set thread context of 852 1420 b78f5c47_by_Libranalysis.exe diskperf.exe PID 1680 set thread context of 1488 1680 explorer.exe explorer.exe PID 1680 set thread context of 632 1680 explorer.exe diskperf.exe PID 1356 set thread context of 3180 1356 spoolsv.exe spoolsv.exe PID 1356 set thread context of 3188 1356 spoolsv.exe diskperf.exe PID 568 set thread context of 3228 568 spoolsv.exe spoolsv.exe PID 568 set thread context of 3236 568 spoolsv.exe diskperf.exe PID 1836 set thread context of 3260 1836 spoolsv.exe spoolsv.exe PID 1836 set thread context of 3268 1836 spoolsv.exe diskperf.exe PID 688 set thread context of 3296 688 spoolsv.exe spoolsv.exe PID 688 set thread context of 3304 688 spoolsv.exe diskperf.exe PID 1100 set thread context of 3336 1100 spoolsv.exe spoolsv.exe PID 1100 set thread context of 3344 1100 spoolsv.exe diskperf.exe PID 1620 set thread context of 3368 1620 spoolsv.exe spoolsv.exe PID 1620 set thread context of 3376 1620 spoolsv.exe diskperf.exe PID 1736 set thread context of 3404 1736 spoolsv.exe spoolsv.exe PID 1736 set thread context of 3412 1736 spoolsv.exe diskperf.exe PID 1108 set thread context of 3440 1108 spoolsv.exe spoolsv.exe PID 1108 set thread context of 3448 1108 spoolsv.exe diskperf.exe PID 816 set thread context of 3472 816 spoolsv.exe spoolsv.exe PID 816 set thread context of 3480 816 spoolsv.exe diskperf.exe PID 956 set thread context of 3508 956 spoolsv.exe spoolsv.exe PID 956 set thread context of 3516 956 spoolsv.exe diskperf.exe PID 1704 set thread context of 3540 1704 spoolsv.exe spoolsv.exe PID 1704 set thread context of 3548 1704 spoolsv.exe diskperf.exe PID 1688 set thread context of 3576 1688 spoolsv.exe spoolsv.exe PID 1688 set thread context of 3584 1688 spoolsv.exe diskperf.exe PID 1724 set thread context of 3604 1724 spoolsv.exe spoolsv.exe PID 1724 set thread context of 3612 1724 spoolsv.exe diskperf.exe PID 1360 set thread context of 3636 1360 spoolsv.exe spoolsv.exe PID 1360 set thread context of 3656 1360 spoolsv.exe diskperf.exe PID 1440 set thread context of 3668 1440 spoolsv.exe spoolsv.exe PID 1440 set thread context of 3676 1440 spoolsv.exe diskperf.exe PID 1912 set thread context of 3704 1912 spoolsv.exe spoolsv.exe PID 1912 set thread context of 3712 1912 spoolsv.exe diskperf.exe PID 1556 set thread context of 3740 1556 spoolsv.exe spoolsv.exe PID 1556 set thread context of 3760 1556 spoolsv.exe diskperf.exe PID 836 set thread context of 3772 836 spoolsv.exe spoolsv.exe PID 836 set thread context of 3792 836 spoolsv.exe diskperf.exe PID 1004 set thread context of 3800 1004 spoolsv.exe spoolsv.exe PID 1004 set thread context of 3808 1004 spoolsv.exe diskperf.exe PID 524 set thread context of 3836 524 spoolsv.exe spoolsv.exe PID 524 set thread context of 3844 524 spoolsv.exe diskperf.exe PID 436 set thread context of 3872 436 spoolsv.exe spoolsv.exe PID 436 set thread context of 3880 436 spoolsv.exe diskperf.exe PID 864 set thread context of 3888 864 spoolsv.exe spoolsv.exe PID 864 set thread context of 3920 864 spoolsv.exe diskperf.exe PID 608 set thread context of 3912 608 spoolsv.exe spoolsv.exe PID 608 set thread context of 3928 608 spoolsv.exe diskperf.exe PID 1092 set thread context of 3936 1092 spoolsv.exe spoolsv.exe PID 1092 set thread context of 3956 1092 spoolsv.exe diskperf.exe PID 1316 set thread context of 3968 1316 spoolsv.exe spoolsv.exe PID 1316 set thread context of 3976 1316 spoolsv.exe diskperf.exe PID 1248 set thread context of 3984 1248 spoolsv.exe spoolsv.exe PID 1248 set thread context of 3992 1248 spoolsv.exe diskperf.exe PID 2040 set thread context of 4000 2040 spoolsv.exe spoolsv.exe PID 2040 set thread context of 4008 2040 spoolsv.exe diskperf.exe PID 1260 set thread context of 4028 1260 spoolsv.exe spoolsv.exe PID 1260 set thread context of 4036 1260 spoolsv.exe diskperf.exe PID 1392 set thread context of 4048 1392 spoolsv.exe spoolsv.exe PID 1392 set thread context of 4056 1392 spoolsv.exe diskperf.exe -
Drops file in Windows directory 4 IoCs
Processes:
b78f5c47_by_Libranalysis.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe b78f5c47_by_Libranalysis.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b78f5c47_by_Libranalysis.exeexplorer.exepid process 1764 b78f5c47_by_Libranalysis.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1488 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
b78f5c47_by_Libranalysis.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1764 b78f5c47_by_Libranalysis.exe 1764 b78f5c47_by_Libranalysis.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 3180 spoolsv.exe 3180 spoolsv.exe 3228 spoolsv.exe 3228 spoolsv.exe 3260 spoolsv.exe 3260 spoolsv.exe 3296 spoolsv.exe 3296 spoolsv.exe 3336 spoolsv.exe 3336 spoolsv.exe 3368 spoolsv.exe 3368 spoolsv.exe 3404 spoolsv.exe 3404 spoolsv.exe 3440 spoolsv.exe 3440 spoolsv.exe 3472 spoolsv.exe 3472 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 3540 spoolsv.exe 3540 spoolsv.exe 3576 spoolsv.exe 3576 spoolsv.exe 3604 spoolsv.exe 3604 spoolsv.exe 3636 spoolsv.exe 3636 spoolsv.exe 3668 spoolsv.exe 3668 spoolsv.exe 3704 spoolsv.exe 3704 spoolsv.exe 3740 spoolsv.exe 3740 spoolsv.exe 3772 spoolsv.exe 3772 spoolsv.exe 3800 spoolsv.exe 3800 spoolsv.exe 3836 spoolsv.exe 3836 spoolsv.exe 3872 spoolsv.exe 3872 spoolsv.exe 3888 spoolsv.exe 3912 spoolsv.exe 3912 spoolsv.exe 3888 spoolsv.exe 3936 spoolsv.exe 3936 spoolsv.exe 3968 spoolsv.exe 3968 spoolsv.exe 3984 spoolsv.exe 3984 spoolsv.exe 4000 spoolsv.exe 4000 spoolsv.exe 4028 spoolsv.exe 4028 spoolsv.exe 4048 spoolsv.exe 4048 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b78f5c47_by_Libranalysis.exeb78f5c47_by_Libranalysis.exeexplorer.exeexplorer.exedescription pid process target process PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 1764 1420 b78f5c47_by_Libranalysis.exe b78f5c47_by_Libranalysis.exe PID 1420 wrote to memory of 852 1420 b78f5c47_by_Libranalysis.exe diskperf.exe PID 1420 wrote to memory of 852 1420 b78f5c47_by_Libranalysis.exe diskperf.exe PID 1420 wrote to memory of 852 1420 b78f5c47_by_Libranalysis.exe diskperf.exe PID 1420 wrote to memory of 852 1420 b78f5c47_by_Libranalysis.exe diskperf.exe PID 1420 wrote to memory of 852 1420 b78f5c47_by_Libranalysis.exe diskperf.exe PID 1420 wrote to memory of 852 1420 b78f5c47_by_Libranalysis.exe diskperf.exe PID 1764 wrote to memory of 1680 1764 b78f5c47_by_Libranalysis.exe explorer.exe PID 1764 wrote to memory of 1680 1764 b78f5c47_by_Libranalysis.exe explorer.exe PID 1764 wrote to memory of 1680 1764 b78f5c47_by_Libranalysis.exe explorer.exe PID 1764 wrote to memory of 1680 1764 b78f5c47_by_Libranalysis.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 1488 1680 explorer.exe explorer.exe PID 1680 wrote to memory of 632 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 632 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 632 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 632 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 632 1680 explorer.exe diskperf.exe PID 1680 wrote to memory of 632 1680 explorer.exe diskperf.exe PID 1488 wrote to memory of 1356 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1356 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1356 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1356 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 568 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 568 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 568 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 568 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1836 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1836 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1836 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1836 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 688 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 688 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 688 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 688 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1100 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1100 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1100 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1100 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1620 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1620 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1620 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1620 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1736 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1736 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1736 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1736 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1108 1488 explorer.exe spoolsv.exe PID 1488 wrote to memory of 1108 1488 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b78f5c47_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\b78f5c47_by_Libranalysis.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b78f5c47_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\b78f5c47_by_Libranalysis.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeMD5
b78f5c47acef55129ff8d9862c477dcf
SHA14c8d602143a1a2fd5201ec4214cee155101e5911
SHA256bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1
SHA512d18d7a9999a9f50236efe551667dc9c6e226cfd6151a45d7712d980779599d9f5f81f74d97910b73f907e0ba54a85fb38fb5c489ac3cbbbaf49a39f7be28330e
-
C:\Users\Admin\AppData\Local\Temp\Disk.sysMD5
d6d2efcd57f3b93a8d16adbb24c2f420
SHA18104b9ce0a888935821cde6efcd125fc1c211af9
SHA256df9e4abccb4489f5c57ece23410fb935cb541643779884d3cbb3c2db617c7f50
SHA512ec347a147677ab5c4d53a737f6d5ac60383b8ea2a48e5bb444744ef22ee84ae00af0c0cfa56db2fdf11c39a84f0fba3e34377716f3b2ade988ed15cd0ec980d6
-
C:\Windows\system\explorer.exeMD5
d6d2efcd57f3b93a8d16adbb24c2f420
SHA18104b9ce0a888935821cde6efcd125fc1c211af9
SHA256df9e4abccb4489f5c57ece23410fb935cb541643779884d3cbb3c2db617c7f50
SHA512ec347a147677ab5c4d53a737f6d5ac60383b8ea2a48e5bb444744ef22ee84ae00af0c0cfa56db2fdf11c39a84f0fba3e34377716f3b2ade988ed15cd0ec980d6
-
C:\Windows\system\explorer.exeMD5
d6d2efcd57f3b93a8d16adbb24c2f420
SHA18104b9ce0a888935821cde6efcd125fc1c211af9
SHA256df9e4abccb4489f5c57ece23410fb935cb541643779884d3cbb3c2db617c7f50
SHA512ec347a147677ab5c4d53a737f6d5ac60383b8ea2a48e5bb444744ef22ee84ae00af0c0cfa56db2fdf11c39a84f0fba3e34377716f3b2ade988ed15cd0ec980d6
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
C:\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\??\c:\windows\system\explorer.exeMD5
d6d2efcd57f3b93a8d16adbb24c2f420
SHA18104b9ce0a888935821cde6efcd125fc1c211af9
SHA256df9e4abccb4489f5c57ece23410fb935cb541643779884d3cbb3c2db617c7f50
SHA512ec347a147677ab5c4d53a737f6d5ac60383b8ea2a48e5bb444744ef22ee84ae00af0c0cfa56db2fdf11c39a84f0fba3e34377716f3b2ade988ed15cd0ec980d6
-
\Windows\system\explorer.exeMD5
d6d2efcd57f3b93a8d16adbb24c2f420
SHA18104b9ce0a888935821cde6efcd125fc1c211af9
SHA256df9e4abccb4489f5c57ece23410fb935cb541643779884d3cbb3c2db617c7f50
SHA512ec347a147677ab5c4d53a737f6d5ac60383b8ea2a48e5bb444744ef22ee84ae00af0c0cfa56db2fdf11c39a84f0fba3e34377716f3b2ade988ed15cd0ec980d6
-
\Windows\system\explorer.exeMD5
d6d2efcd57f3b93a8d16adbb24c2f420
SHA18104b9ce0a888935821cde6efcd125fc1c211af9
SHA256df9e4abccb4489f5c57ece23410fb935cb541643779884d3cbb3c2db617c7f50
SHA512ec347a147677ab5c4d53a737f6d5ac60383b8ea2a48e5bb444744ef22ee84ae00af0c0cfa56db2fdf11c39a84f0fba3e34377716f3b2ade988ed15cd0ec980d6
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
\Windows\system\spoolsv.exeMD5
fbef45d8da4104f116d64ba90a140dd1
SHA11288d83e3272d54e8ba6bfdfd8879f116f38107c
SHA256a05a6a327178c2d9a7b6b5b89330d48d64de0ba6ed96d473dae92a5175671fd3
SHA5129e42e0c76ba032aaea3513a4b2eecd2a3b386acc6a9d67c077ec9b74fe45b87a480f46a569106112028640bba9502f4c444a8e24609e7bc834c60887fb6dd1d8
-
memory/320-310-0x0000000000000000-mapping.dmp
-
memory/332-264-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/332-253-0x0000000000000000-mapping.dmp
-
memory/396-263-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/396-251-0x0000000000000000-mapping.dmp
-
memory/436-210-0x0000000000000000-mapping.dmp
-
memory/436-223-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/524-207-0x0000000000000000-mapping.dmp
-
memory/568-101-0x0000000000000000-mapping.dmp
-
memory/568-105-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/572-314-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/572-308-0x0000000000000000-mapping.dmp
-
memory/608-225-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/608-214-0x0000000000000000-mapping.dmp
-
memory/632-86-0x0000000000411000-mapping.dmp
-
memory/644-235-0x0000000000000000-mapping.dmp
-
memory/644-244-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/688-120-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/688-113-0x0000000000000000-mapping.dmp
-
memory/800-294-0x0000000000000000-mapping.dmp
-
memory/816-143-0x0000000000000000-mapping.dmp
-
memory/816-150-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/836-198-0x0000000000000000-mapping.dmp
-
memory/836-206-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/852-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-66-0x0000000000411000-mapping.dmp
-
memory/864-224-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/864-212-0x0000000000000000-mapping.dmp
-
memory/900-239-0x0000000000000000-mapping.dmp
-
memory/900-246-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/940-300-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/940-293-0x0000000000000000-mapping.dmp
-
memory/944-237-0x0000000000000000-mapping.dmp
-
memory/948-272-0x0000000000000000-mapping.dmp
-
memory/948-284-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/956-149-0x0000000000000000-mapping.dmp
-
memory/956-158-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1004-203-0x0000000000000000-mapping.dmp
-
memory/1008-297-0x0000000000000000-mapping.dmp
-
memory/1068-257-0x0000000000000000-mapping.dmp
-
memory/1092-216-0x0000000000000000-mapping.dmp
-
memory/1092-226-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1100-119-0x0000000000000000-mapping.dmp
-
memory/1100-132-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1108-138-0x0000000000000000-mapping.dmp
-
memory/1108-146-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1164-247-0x0000000000000000-mapping.dmp
-
memory/1172-274-0x0000000000000000-mapping.dmp
-
memory/1172-285-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1188-311-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1188-305-0x0000000000000000-mapping.dmp
-
memory/1196-270-0x0000000000000000-mapping.dmp
-
memory/1196-283-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1248-220-0x0000000000000000-mapping.dmp
-
memory/1252-276-0x0000000000000000-mapping.dmp
-
memory/1260-242-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1260-231-0x0000000000000000-mapping.dmp
-
memory/1316-227-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1316-218-0x0000000000000000-mapping.dmp
-
memory/1336-259-0x0000000000000000-mapping.dmp
-
memory/1356-104-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1356-96-0x0000000000000000-mapping.dmp
-
memory/1360-182-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1360-174-0x0000000000000000-mapping.dmp
-
memory/1380-299-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1380-291-0x0000000000000000-mapping.dmp
-
memory/1392-233-0x0000000000000000-mapping.dmp
-
memory/1420-60-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1420-61-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1440-183-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1440-179-0x0000000000000000-mapping.dmp
-
memory/1488-81-0x0000000000403670-mapping.dmp
-
memory/1504-309-0x0000000000000000-mapping.dmp
-
memory/1528-289-0x0000000000000000-mapping.dmp
-
memory/1556-191-0x0000000000000000-mapping.dmp
-
memory/1576-255-0x0000000000000000-mapping.dmp
-
memory/1604-303-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1604-296-0x0000000000000000-mapping.dmp
-
memory/1620-125-0x0000000000000000-mapping.dmp
-
memory/1620-134-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1668-287-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/1668-278-0x0000000000000000-mapping.dmp
-
memory/1676-249-0x0000000000000000-mapping.dmp
-
memory/1680-268-0x0000000000000000-mapping.dmp
-
memory/1680-282-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1680-75-0x0000000000000000-mapping.dmp
-
memory/1680-78-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1688-162-0x0000000000000000-mapping.dmp
-
memory/1688-170-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1704-155-0x0000000000000000-mapping.dmp
-
memory/1704-159-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1708-295-0x0000000000000000-mapping.dmp
-
memory/1708-302-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1724-167-0x0000000000000000-mapping.dmp
-
memory/1724-171-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1736-130-0x0000000000000000-mapping.dmp
-
memory/1736-135-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1764-63-0x0000000000403670-mapping.dmp
-
memory/1764-62-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1764-71-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1796-306-0x0000000000000000-mapping.dmp
-
memory/1796-312-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1836-117-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1836-108-0x0000000000000000-mapping.dmp
-
memory/1848-280-0x0000000000000000-mapping.dmp
-
memory/1848-288-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1912-186-0x0000000000000000-mapping.dmp
-
memory/1912-194-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1996-307-0x0000000000000000-mapping.dmp
-
memory/2040-229-0x0000000000000000-mapping.dmp