Analysis
-
max time kernel
150s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 00:03
Static task
static1
Behavioral task
behavioral1
Sample
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe
Resource
win10v20210410
General
-
Target
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe
-
Size
1.8MB
-
MD5
b6c8a4f497f3d7a552cb01272123a0f5
-
SHA1
ab35e3b7d7245a7ebffa74898d788c1938c244e9
-
SHA256
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf
-
SHA512
c8507bc0cf0c1ea6e2ba127236fb3d78d93ead60dec2a71c85fa4067047c8df3077f184f383994ef32c5b67559c7a2d065a3c041258cc542ce9ff82e4aa05204
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 64 IoCs
Processes:
resource yara_rule \Windows\system\explorer.exe warzonerat \Windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat \??\c:\windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Users\Admin\AppData\Local\Temp\Disk.sys warzonerat C:\Windows\system\explorer.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 432 explorer.exe 1052 explorer.exe 1484 spoolsv.exe 1956 spoolsv.exe 1728 spoolsv.exe 1752 spoolsv.exe 1756 spoolsv.exe 2012 spoolsv.exe 1148 spoolsv.exe 900 spoolsv.exe 1684 spoolsv.exe 752 spoolsv.exe 804 spoolsv.exe 1680 spoolsv.exe 1360 spoolsv.exe 1824 spoolsv.exe 2028 spoolsv.exe 1644 spoolsv.exe 1200 spoolsv.exe 864 spoolsv.exe 924 spoolsv.exe 1348 spoolsv.exe 1848 spoolsv.exe 892 spoolsv.exe 788 spoolsv.exe 1596 spoolsv.exe 1256 spoolsv.exe 1516 spoolsv.exe 1308 spoolsv.exe 1976 spoolsv.exe 1544 spoolsv.exe 888 spoolsv.exe 972 spoolsv.exe 1604 spoolsv.exe 1600 spoolsv.exe 1992 spoolsv.exe 1192 spoolsv.exe 1952 spoolsv.exe 2008 spoolsv.exe 1664 spoolsv.exe 1940 spoolsv.exe 932 spoolsv.exe 1012 spoolsv.exe 436 spoolsv.exe 1912 spoolsv.exe 1920 spoolsv.exe 1080 spoolsv.exe 1300 spoolsv.exe 1780 spoolsv.exe 1636 spoolsv.exe 1648 spoolsv.exe 600 spoolsv.exe 1768 spoolsv.exe 1576 spoolsv.exe 840 spoolsv.exe 1864 spoolsv.exe 956 spoolsv.exe 980 spoolsv.exe 1424 spoolsv.exe 1068 spoolsv.exe 1160 spoolsv.exe 532 spoolsv.exe 1612 spoolsv.exe 1060 spoolsv.exe -
Modifies Installed Components in the registry 2 TTPs
-
Loads dropped DLL 64 IoCs
Processes:
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exeexplorer.exepid process 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe -
Adds Run key to start application 2 TTPs 38 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exea56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1084 set thread context of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 set thread context of 1532 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe diskperf.exe PID 432 set thread context of 1052 432 explorer.exe explorer.exe PID 432 set thread context of 824 432 explorer.exe diskperf.exe PID 1484 set thread context of 3096 1484 spoolsv.exe spoolsv.exe PID 1484 set thread context of 3104 1484 spoolsv.exe diskperf.exe PID 1956 set thread context of 3140 1956 spoolsv.exe spoolsv.exe PID 1956 set thread context of 3160 1956 spoolsv.exe diskperf.exe PID 1728 set thread context of 3176 1728 spoolsv.exe spoolsv.exe PID 1728 set thread context of 3184 1728 spoolsv.exe diskperf.exe PID 1752 set thread context of 3204 1752 spoolsv.exe spoolsv.exe PID 1752 set thread context of 3212 1752 spoolsv.exe diskperf.exe PID 1756 set thread context of 3240 1756 spoolsv.exe spoolsv.exe PID 1756 set thread context of 3248 1756 spoolsv.exe diskperf.exe PID 2012 set thread context of 3276 2012 spoolsv.exe spoolsv.exe PID 2012 set thread context of 3284 2012 spoolsv.exe diskperf.exe PID 1148 set thread context of 3304 1148 spoolsv.exe spoolsv.exe PID 1148 set thread context of 3312 1148 spoolsv.exe diskperf.exe PID 900 set thread context of 3340 900 spoolsv.exe spoolsv.exe PID 900 set thread context of 3348 900 spoolsv.exe diskperf.exe PID 1684 set thread context of 3372 1684 spoolsv.exe spoolsv.exe PID 1684 set thread context of 3380 1684 spoolsv.exe diskperf.exe PID 752 set thread context of 3408 752 spoolsv.exe spoolsv.exe PID 752 set thread context of 3416 752 spoolsv.exe diskperf.exe PID 804 set thread context of 3444 804 spoolsv.exe spoolsv.exe PID 804 set thread context of 3452 804 spoolsv.exe diskperf.exe PID 1680 set thread context of 3476 1680 spoolsv.exe spoolsv.exe PID 1680 set thread context of 3484 1680 spoolsv.exe diskperf.exe PID 1360 set thread context of 3512 1360 spoolsv.exe spoolsv.exe PID 1360 set thread context of 3520 1360 spoolsv.exe diskperf.exe PID 1824 set thread context of 3540 1824 spoolsv.exe spoolsv.exe PID 1824 set thread context of 3548 1824 spoolsv.exe diskperf.exe PID 2028 set thread context of 3580 2028 spoolsv.exe spoolsv.exe PID 2028 set thread context of 3588 2028 spoolsv.exe diskperf.exe PID 1644 set thread context of 3608 1644 spoolsv.exe spoolsv.exe PID 1644 set thread context of 3616 1644 spoolsv.exe diskperf.exe PID 1200 set thread context of 3628 1200 spoolsv.exe spoolsv.exe PID 1200 set thread context of 3636 1200 spoolsv.exe diskperf.exe PID 864 set thread context of 3656 864 spoolsv.exe spoolsv.exe PID 864 set thread context of 3664 864 spoolsv.exe diskperf.exe PID 924 set thread context of 3692 924 spoolsv.exe spoolsv.exe PID 924 set thread context of 3700 924 spoolsv.exe diskperf.exe PID 1348 set thread context of 3720 1348 spoolsv.exe spoolsv.exe PID 1348 set thread context of 3736 1348 spoolsv.exe diskperf.exe PID 1848 set thread context of 3728 1848 spoolsv.exe spoolsv.exe PID 1848 set thread context of 3744 1848 spoolsv.exe diskperf.exe PID 892 set thread context of 3768 892 spoolsv.exe spoolsv.exe PID 892 set thread context of 3776 892 spoolsv.exe diskperf.exe PID 1596 set thread context of 3784 1596 spoolsv.exe spoolsv.exe PID 1596 set thread context of 3804 1596 spoolsv.exe diskperf.exe PID 788 set thread context of 3812 788 spoolsv.exe spoolsv.exe PID 788 set thread context of 3820 788 spoolsv.exe diskperf.exe PID 1256 set thread context of 3840 1256 spoolsv.exe spoolsv.exe PID 1256 set thread context of 3848 1256 spoolsv.exe diskperf.exe PID 1308 set thread context of 3876 1308 spoolsv.exe spoolsv.exe PID 1308 set thread context of 3884 1308 spoolsv.exe diskperf.exe PID 1516 set thread context of 3868 1516 spoolsv.exe spoolsv.exe PID 1516 set thread context of 3904 1516 spoolsv.exe diskperf.exe PID 1976 set thread context of 3912 1976 spoolsv.exe spoolsv.exe PID 1976 set thread context of 3920 1976 spoolsv.exe diskperf.exe PID 1544 set thread context of 3928 1544 spoolsv.exe spoolsv.exe PID 1544 set thread context of 3936 1544 spoolsv.exe diskperf.exe PID 888 set thread context of 3956 888 spoolsv.exe spoolsv.exe PID 888 set thread context of 3964 888 spoolsv.exe diskperf.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exespoolsv.exea56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exeexplorer.exepid process 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1052 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 3096 spoolsv.exe 3096 spoolsv.exe 3140 spoolsv.exe 3140 spoolsv.exe 3176 spoolsv.exe 3176 spoolsv.exe 3204 spoolsv.exe 3204 spoolsv.exe 3240 spoolsv.exe 3240 spoolsv.exe 3276 spoolsv.exe 3276 spoolsv.exe 3304 spoolsv.exe 3304 spoolsv.exe 3340 spoolsv.exe 3340 spoolsv.exe 3372 spoolsv.exe 3372 spoolsv.exe 3408 spoolsv.exe 3408 spoolsv.exe 3444 spoolsv.exe 3444 spoolsv.exe 3476 spoolsv.exe 3476 spoolsv.exe 3512 spoolsv.exe 3512 spoolsv.exe 3540 spoolsv.exe 3540 spoolsv.exe 3580 spoolsv.exe 3580 spoolsv.exe 3608 spoolsv.exe 3608 spoolsv.exe 3628 spoolsv.exe 3628 spoolsv.exe 3656 spoolsv.exe 3656 spoolsv.exe 3692 spoolsv.exe 3692 spoolsv.exe 3720 spoolsv.exe 3728 spoolsv.exe 3720 spoolsv.exe 3728 spoolsv.exe 3768 spoolsv.exe 3768 spoolsv.exe 3784 spoolsv.exe 3784 spoolsv.exe 3812 spoolsv.exe 3812 spoolsv.exe 3840 spoolsv.exe 3840 spoolsv.exe 3876 spoolsv.exe 3876 spoolsv.exe 3868 spoolsv.exe 3868 spoolsv.exe 3912 spoolsv.exe 3912 spoolsv.exe 3928 spoolsv.exe 3928 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exea56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exeexplorer.exeexplorer.exedescription pid process target process PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1680 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe PID 1084 wrote to memory of 1532 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe diskperf.exe PID 1680 wrote to memory of 432 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe explorer.exe PID 1680 wrote to memory of 432 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe explorer.exe PID 1680 wrote to memory of 432 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe explorer.exe PID 1680 wrote to memory of 432 1680 a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 1052 432 explorer.exe explorer.exe PID 432 wrote to memory of 824 432 explorer.exe diskperf.exe PID 432 wrote to memory of 824 432 explorer.exe diskperf.exe PID 432 wrote to memory of 824 432 explorer.exe diskperf.exe PID 432 wrote to memory of 824 432 explorer.exe diskperf.exe PID 432 wrote to memory of 824 432 explorer.exe diskperf.exe PID 432 wrote to memory of 824 432 explorer.exe diskperf.exe PID 1052 wrote to memory of 1484 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1484 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1484 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1484 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1956 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1956 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1956 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1956 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1728 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1728 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1728 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1728 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1752 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1752 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1752 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1752 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1756 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1756 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1756 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1756 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 2012 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 2012 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 2012 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 2012 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1148 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1148 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1148 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 1148 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 900 1052 explorer.exe spoolsv.exe PID 1052 wrote to memory of 900 1052 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe"C:\Users\Admin\AppData\Local\Temp\a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe"C:\Users\Admin\AppData\Local\Temp\a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeMD5
b6c8a4f497f3d7a552cb01272123a0f5
SHA1ab35e3b7d7245a7ebffa74898d788c1938c244e9
SHA256a56e874dafa172b5366252e62b9776a1d61c9c4287c712cc56f65571bcd59acf
SHA512c8507bc0cf0c1ea6e2ba127236fb3d78d93ead60dec2a71c85fa4067047c8df3077f184f383994ef32c5b67559c7a2d065a3c041258cc542ce9ff82e4aa05204
-
C:\Users\Admin\AppData\Local\Temp\Disk.sysMD5
4e0e3800a923298c3ca1ed4ac2c04d43
SHA1749e1ee0631dbe0c0d3d0ad3b9f2452cc03e78e3
SHA25645e5f03018992f1e630ba7ec8c91ae66eb7f368367478fb5cf30a0b0caef2ce9
SHA512ef93a08f98ac661762fd45efe60045de37e448dfafbbce73e4a72adb8aaf23ae6f14b7dc78c71c5b2b91be496c15478554d8192043f508b383eb04d8bd261590
-
C:\Windows\system\explorer.exeMD5
4e0e3800a923298c3ca1ed4ac2c04d43
SHA1749e1ee0631dbe0c0d3d0ad3b9f2452cc03e78e3
SHA25645e5f03018992f1e630ba7ec8c91ae66eb7f368367478fb5cf30a0b0caef2ce9
SHA512ef93a08f98ac661762fd45efe60045de37e448dfafbbce73e4a72adb8aaf23ae6f14b7dc78c71c5b2b91be496c15478554d8192043f508b383eb04d8bd261590
-
C:\Windows\system\explorer.exeMD5
4e0e3800a923298c3ca1ed4ac2c04d43
SHA1749e1ee0631dbe0c0d3d0ad3b9f2452cc03e78e3
SHA25645e5f03018992f1e630ba7ec8c91ae66eb7f368367478fb5cf30a0b0caef2ce9
SHA512ef93a08f98ac661762fd45efe60045de37e448dfafbbce73e4a72adb8aaf23ae6f14b7dc78c71c5b2b91be496c15478554d8192043f508b383eb04d8bd261590
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
C:\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\??\c:\windows\system\explorer.exeMD5
4e0e3800a923298c3ca1ed4ac2c04d43
SHA1749e1ee0631dbe0c0d3d0ad3b9f2452cc03e78e3
SHA25645e5f03018992f1e630ba7ec8c91ae66eb7f368367478fb5cf30a0b0caef2ce9
SHA512ef93a08f98ac661762fd45efe60045de37e448dfafbbce73e4a72adb8aaf23ae6f14b7dc78c71c5b2b91be496c15478554d8192043f508b383eb04d8bd261590
-
\Windows\system\explorer.exeMD5
4e0e3800a923298c3ca1ed4ac2c04d43
SHA1749e1ee0631dbe0c0d3d0ad3b9f2452cc03e78e3
SHA25645e5f03018992f1e630ba7ec8c91ae66eb7f368367478fb5cf30a0b0caef2ce9
SHA512ef93a08f98ac661762fd45efe60045de37e448dfafbbce73e4a72adb8aaf23ae6f14b7dc78c71c5b2b91be496c15478554d8192043f508b383eb04d8bd261590
-
\Windows\system\explorer.exeMD5
4e0e3800a923298c3ca1ed4ac2c04d43
SHA1749e1ee0631dbe0c0d3d0ad3b9f2452cc03e78e3
SHA25645e5f03018992f1e630ba7ec8c91ae66eb7f368367478fb5cf30a0b0caef2ce9
SHA512ef93a08f98ac661762fd45efe60045de37e448dfafbbce73e4a72adb8aaf23ae6f14b7dc78c71c5b2b91be496c15478554d8192043f508b383eb04d8bd261590
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
\Windows\system\spoolsv.exeMD5
66c328f05ab81725c787e3ca40e40672
SHA12e0645a1971c49e93c7690f6dc9a0b85a8a3949d
SHA25634d5c19ec33180459efd50ad51c05218e5212e94f0bce6d90cb03bb593366075
SHA512250388f5e9dfaaa17807158797c20511d72c003b07e85cd3cc358c851078513c86a37cb3985a22501533e92f62462b099b2b26a147b75626c0e0b73db4992e2c
-
memory/432-73-0x0000000000000000-mapping.dmp
-
memory/432-78-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/436-282-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/436-272-0x0000000000000000-mapping.dmp
-
memory/600-293-0x0000000000000000-mapping.dmp
-
memory/600-301-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/752-148-0x0000000000000000-mapping.dmp
-
memory/788-214-0x0000000000000000-mapping.dmp
-
memory/788-223-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/804-156-0x0000000000000000-mapping.dmp
-
memory/804-159-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/824-86-0x0000000000411000-mapping.dmp
-
memory/840-303-0x0000000000000000-mapping.dmp
-
memory/864-198-0x0000000000000000-mapping.dmp
-
memory/864-206-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/888-234-0x0000000000000000-mapping.dmp
-
memory/888-244-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/892-212-0x0000000000000000-mapping.dmp
-
memory/900-149-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/900-137-0x0000000000000000-mapping.dmp
-
memory/924-203-0x0000000000000000-mapping.dmp
-
memory/924-207-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/932-268-0x0000000000000000-mapping.dmp
-
memory/932-280-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/956-305-0x0000000000000000-mapping.dmp
-
memory/972-245-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/972-236-0x0000000000000000-mapping.dmp
-
memory/980-312-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/980-306-0x0000000000000000-mapping.dmp
-
memory/1012-281-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1012-270-0x0000000000000000-mapping.dmp
-
memory/1052-81-0x0000000000403670-mapping.dmp
-
memory/1068-314-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1068-308-0x0000000000000000-mapping.dmp
-
memory/1080-278-0x0000000000000000-mapping.dmp
-
memory/1084-60-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/1084-61-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1148-145-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1148-131-0x0000000000000000-mapping.dmp
-
memory/1160-315-0x0000000000000000-mapping.dmp
-
memory/1192-263-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1192-251-0x0000000000000000-mapping.dmp
-
memory/1200-195-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1200-191-0x0000000000000000-mapping.dmp
-
memory/1256-218-0x0000000000000000-mapping.dmp
-
memory/1256-225-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1300-286-0x0000000000000000-mapping.dmp
-
memory/1308-241-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1308-228-0x0000000000000000-mapping.dmp
-
memory/1348-208-0x0000000000000000-mapping.dmp
-
memory/1360-167-0x0000000000000000-mapping.dmp
-
memory/1424-313-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1424-307-0x0000000000000000-mapping.dmp
-
memory/1484-96-0x0000000000000000-mapping.dmp
-
memory/1484-104-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1516-226-0x0000000000000000-mapping.dmp
-
memory/1532-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1532-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1532-68-0x0000000000411000-mapping.dmp
-
memory/1544-232-0x0000000000000000-mapping.dmp
-
memory/1544-243-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1576-296-0x0000000000000000-mapping.dmp
-
memory/1596-224-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1596-216-0x0000000000000000-mapping.dmp
-
memory/1600-261-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1600-247-0x0000000000000000-mapping.dmp
-
memory/1604-238-0x0000000000000000-mapping.dmp
-
memory/1636-290-0x0000000000000000-mapping.dmp
-
memory/1636-298-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1644-186-0x0000000000000000-mapping.dmp
-
memory/1644-194-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1648-292-0x0000000000000000-mapping.dmp
-
memory/1648-300-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/1664-266-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1664-257-0x0000000000000000-mapping.dmp
-
memory/1680-75-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1680-62-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1680-162-0x0000000000000000-mapping.dmp
-
memory/1680-170-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1680-63-0x0000000000403670-mapping.dmp
-
memory/1684-142-0x0000000000000000-mapping.dmp
-
memory/1684-151-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1728-108-0x0000000000000000-mapping.dmp
-
memory/1728-117-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1752-120-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1752-113-0x0000000000000000-mapping.dmp
-
memory/1756-128-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1756-119-0x0000000000000000-mapping.dmp
-
memory/1768-294-0x0000000000000000-mapping.dmp
-
memory/1780-288-0x0000000000000000-mapping.dmp
-
memory/1780-297-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1824-174-0x0000000000000000-mapping.dmp
-
memory/1848-221-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1848-210-0x0000000000000000-mapping.dmp
-
memory/1864-304-0x0000000000000000-mapping.dmp
-
memory/1864-310-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1912-274-0x0000000000000000-mapping.dmp
-
memory/1920-276-0x0000000000000000-mapping.dmp
-
memory/1920-284-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1940-267-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1940-259-0x0000000000000000-mapping.dmp
-
memory/1952-264-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1952-253-0x0000000000000000-mapping.dmp
-
memory/1956-105-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1956-101-0x0000000000000000-mapping.dmp
-
memory/1976-230-0x0000000000000000-mapping.dmp
-
memory/1992-249-0x0000000000000000-mapping.dmp
-
memory/2008-265-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2008-255-0x0000000000000000-mapping.dmp
-
memory/2012-132-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2012-125-0x0000000000000000-mapping.dmp
-
memory/2028-179-0x0000000000000000-mapping.dmp
-
memory/2028-183-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB