warzonerat | 794b9a2b8b506360ba92a9a69c40b303b37e43e88ae408db8a1b86c741014968

Analysis

max time kernel
149s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
Size

2.9MB
MD5

10e2dd4f425ef30d4f3fe5ec98a03d5d
SHA1

2e2b1af404c9d6bde505b373c50fc19872c91498
SHA256

794b9a2b8b506360ba92a9a69c40b303b37e43e88ae408db8a1b86c741014968
SHA512

65483b97cf8e46f33700da4e70434f7be3270ab8eacafe1a36a460b2886e3ffa44a4ba4e29f05eeaeee665f0e60990065854fc622866ebe0df422c60c9238047
SSDEEP

24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHt:3Ty7A3mw4gxeOw46fUbNecCCFbNecU

Score

10^/10

warzonerat evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
C:\Windows\system\explorer.exe	warzonerat
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 32 IoCs

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exe

pid	process
2368	explorer.exe
328	explorer.exe
1168	explorer.exe
1260	spoolsv.exe
2792	spoolsv.exe
1492	spoolsv.exe
2800	spoolsv.exe
2444	spoolsv.exe
2176	spoolsv.exe
2832	spoolsv.exe
2160	spoolsv.exe
1496	spoolsv.exe
2328	spoolsv.exe
2352	spoolsv.exe
1912	spoolsv.exe
2148	spoolsv.exe
456	spoolsv.exe
2876	spoolsv.exe
912	spoolsv.exe
2768	spoolsv.exe
812	spoolsv.exe
2572	spoolsv.exe
2644	spoolsv.exe
2124	spoolsv.exe
2944	spoolsv.exe
2024	spoolsv.exe
1568	spoolsv.exe
3032	spoolsv.exe
608	spoolsv.exe
1892	spoolsv.exe
916	spoolsv.exe
2864	spoolsv.exe
2648	spoolsv.exe
2568	spoolsv.exe
2796	spoolsv.exe
2332	spoolsv.exe
1372	spoolsv.exe
2824	spoolsv.exe
2084	spoolsv.exe
1976	spoolsv.exe
2356	spoolsv.exe
1744	spoolsv.exe
800	spoolsv.exe
1044	spoolsv.exe
2872	spoolsv.exe
2456	spoolsv.exe
2272	spoolsv.exe
2612	spoolsv.exe
2468	spoolsv.exe
2124	spoolsv.exe
1228	spoolsv.exe
1864	spoolsv.exe
2216	spoolsv.exe
2148	spoolsv.exe
288	spoolsv.exe
888	spoolsv.exe
1940	spoolsv.exe
2840	spoolsv.exe
1616	spoolsv.exe
2660	spoolsv.exe
2332	spoolsv.exe
1684	explorer.exe
1496	spoolsv.exe
2720	spoolsv.exe

Loads dropped DLL 64 IoCs

Processes:

10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
1168	explorer.exe
1168	explorer.exe
1260	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
1492	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2444	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2832	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
1496	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2352	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2148	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2876	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2768	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2572	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2124	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2024	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
3032	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
1892	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2864	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2568	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2332	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
2824	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
1976	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
1744	spoolsv.exe
1168	explorer.exe
1168	explorer.exe

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

description	pid	process	target process
PID 2264 set thread context of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 set thread context of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 set thread context of 1324	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	diskperf.exe
PID 2368 set thread context of 328	2368	explorer.exe	explorer.exe
PID 328 set thread context of 1168	328	explorer.exe	explorer.exe
PID 328 set thread context of 2280	328	explorer.exe	diskperf.exe
PID 1260 set thread context of 2792	1260	spoolsv.exe	spoolsv.exe
PID 1492 set thread context of 2800	1492	spoolsv.exe	spoolsv.exe
PID 2444 set thread context of 2176	2444	spoolsv.exe	spoolsv.exe
PID 2832 set thread context of 2160	2832	spoolsv.exe	spoolsv.exe
PID 1496 set thread context of 2328	1496	spoolsv.exe	spoolsv.exe
PID 2352 set thread context of 1912	2352	spoolsv.exe	spoolsv.exe
PID 2148 set thread context of 456	2148	spoolsv.exe	spoolsv.exe
PID 2876 set thread context of 912	2876	spoolsv.exe	spoolsv.exe
PID 2768 set thread context of 812	2768	spoolsv.exe	spoolsv.exe
PID 2572 set thread context of 2644	2572	spoolsv.exe	spoolsv.exe
PID 2124 set thread context of 2944	2124	spoolsv.exe	spoolsv.exe
PID 2024 set thread context of 1568	2024	spoolsv.exe	spoolsv.exe
PID 3032 set thread context of 608	3032	spoolsv.exe	spoolsv.exe
PID 1892 set thread context of 916	1892	spoolsv.exe	spoolsv.exe
PID 2864 set thread context of 2648	2864	spoolsv.exe	spoolsv.exe
PID 2568 set thread context of 2796	2568	spoolsv.exe	spoolsv.exe
PID 2332 set thread context of 1372	2332	spoolsv.exe	spoolsv.exe
PID 2824 set thread context of 2084	2824	spoolsv.exe	spoolsv.exe
PID 1976 set thread context of 2356	1976	spoolsv.exe	spoolsv.exe
PID 1744 set thread context of 800	1744	spoolsv.exe	spoolsv.exe
PID 1044 set thread context of 2872	1044	spoolsv.exe	spoolsv.exe
PID 2456 set thread context of 2272	2456	spoolsv.exe	spoolsv.exe
PID 2612 set thread context of 2468	2612	spoolsv.exe	spoolsv.exe
PID 2124 set thread context of 1228	2124	spoolsv.exe	spoolsv.exe
PID 1864 set thread context of 2216	1864	spoolsv.exe	spoolsv.exe
PID 2148 set thread context of 288	2148	spoolsv.exe	spoolsv.exe
PID 888 set thread context of 1940	888	spoolsv.exe	spoolsv.exe
PID 2840 set thread context of 1616	2840	spoolsv.exe	spoolsv.exe
PID 2792 set thread context of 2332	2792	spoolsv.exe	spoolsv.exe
PID 2792 set thread context of 1588	2792	spoolsv.exe	diskperf.exe
PID 2660 set thread context of 1496	2660	spoolsv.exe	spoolsv.exe
PID 2720 set thread context of 1864	2720	spoolsv.exe	spoolsv.exe
PID 1684 set thread context of 1656	1684	explorer.exe	explorer.exe
PID 2176 set thread context of 1860	2176	spoolsv.exe	spoolsv.exe
PID 2176 set thread context of 2012	2176	spoolsv.exe	diskperf.exe
PID 1540 set thread context of 2344	1540	spoolsv.exe	spoolsv.exe
PID 2160 set thread context of 2524	2160	spoolsv.exe	spoolsv.exe
PID 3048 set thread context of 2620	3048	explorer.exe	explorer.exe
PID 2160 set thread context of 1508	2160	spoolsv.exe	diskperf.exe
PID 2328 set thread context of 376	2328	spoolsv.exe	spoolsv.exe
PID 2328 set thread context of 1564	2328	spoolsv.exe	diskperf.exe
PID 1256 set thread context of 984	1256	spoolsv.exe	spoolsv.exe
PID 1912 set thread context of 1628	1912	spoolsv.exe	spoolsv.exe
PID 2692 set thread context of 2504	2692	explorer.exe	explorer.exe
PID 1912 set thread context of 2744	1912	spoolsv.exe	diskperf.exe
PID 456 set thread context of 2760	456	spoolsv.exe	spoolsv.exe
PID 456 set thread context of 2384	456	spoolsv.exe	diskperf.exe
PID 304 set thread context of 1728	304	spoolsv.exe	spoolsv.exe
PID 240 set thread context of 2672	240	explorer.exe	explorer.exe
PID 2668 set thread context of 1288	2668	spoolsv.exe	spoolsv.exe
PID 912 set thread context of 3040	912	spoolsv.exe	spoolsv.exe
PID 912 set thread context of 1420	912	spoolsv.exe	diskperf.exe
PID 812 set thread context of 932	812	spoolsv.exe	spoolsv.exe
PID 812 set thread context of 688	812	spoolsv.exe	diskperf.exe
PID 1988 set thread context of 1212	1988	spoolsv.exe	spoolsv.exe
PID 2708 set thread context of 1948	2708	explorer.exe	explorer.exe
PID 2644 set thread context of 1044	2644	spoolsv.exe	spoolsv.exe
PID 2644 set thread context of 2060	2644	spoolsv.exe	diskperf.exe

Drops file in Windows directory 47 IoCs

Processes:

10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2132 2620 WerFault.exe explorer.exe

pid	pid_target	process	target process
2132	2620	WerFault.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

pid	process
2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2368	explorer.exe
1260	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
1492	spoolsv.exe
1168	explorer.exe
2444	spoolsv.exe
1168	explorer.exe
2832	spoolsv.exe
1168	explorer.exe
1496	spoolsv.exe
1168	explorer.exe
2352	spoolsv.exe
1168	explorer.exe
2148	spoolsv.exe
1168	explorer.exe
2876	spoolsv.exe
1168	explorer.exe
2768	spoolsv.exe
1168	explorer.exe
2572	spoolsv.exe
1168	explorer.exe
2124	spoolsv.exe
1168	explorer.exe
2024	spoolsv.exe
1168	explorer.exe
3032	spoolsv.exe
1168	explorer.exe
1892	spoolsv.exe
1168	explorer.exe
2864	spoolsv.exe
1168	explorer.exe
2568	spoolsv.exe
1168	explorer.exe
2332	spoolsv.exe
1168	explorer.exe
2824	spoolsv.exe
1168	explorer.exe
1976	spoolsv.exe
1168	explorer.exe
1744	spoolsv.exe
1168	explorer.exe
1044	spoolsv.exe
1168	explorer.exe
2456	spoolsv.exe
1168	explorer.exe
2612	spoolsv.exe
1168	explorer.exe
2124	spoolsv.exe
1168	explorer.exe
1864	spoolsv.exe
1168	explorer.exe
2148	spoolsv.exe
1168	explorer.exe
888	spoolsv.exe
1168	explorer.exe
2840	spoolsv.exe
1168	explorer.exe
2660	spoolsv.exe
1168	explorer.exe
1684	explorer.exe
2720	spoolsv.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

pid	process
2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2368	explorer.exe
2368	explorer.exe
1168	explorer.exe
1168	explorer.exe
1260	spoolsv.exe
1260	spoolsv.exe
1168	explorer.exe
1168	explorer.exe
1492	spoolsv.exe
1492	spoolsv.exe
2444	spoolsv.exe
2444	spoolsv.exe
2832	spoolsv.exe
2832	spoolsv.exe
1496	spoolsv.exe
1496	spoolsv.exe
2352	spoolsv.exe
2352	spoolsv.exe
2148	spoolsv.exe
2148	spoolsv.exe
2876	spoolsv.exe
2876	spoolsv.exe
2768	spoolsv.exe
2768	spoolsv.exe
2572	spoolsv.exe
2572	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
2024	spoolsv.exe
2024	spoolsv.exe
3032	spoolsv.exe
3032	spoolsv.exe
1892	spoolsv.exe
1892	spoolsv.exe
2864	spoolsv.exe
2864	spoolsv.exe
2568	spoolsv.exe
2568	spoolsv.exe
2332	spoolsv.exe
2332	spoolsv.exe
2824	spoolsv.exe
2824	spoolsv.exe
1976	spoolsv.exe
1976	spoolsv.exe
1744	spoolsv.exe
1744	spoolsv.exe
1044	spoolsv.exe
1044	spoolsv.exe
2456	spoolsv.exe
2456	spoolsv.exe
2612	spoolsv.exe
2612	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
1864	spoolsv.exe
1864	spoolsv.exe
2148	spoolsv.exe
2148	spoolsv.exe
888	spoolsv.exe
888	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2264 wrote to memory of 1616	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	cmd.exe
PID 2264 wrote to memory of 1616	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	cmd.exe
PID 2264 wrote to memory of 1616	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	cmd.exe
PID 2264 wrote to memory of 1616	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	cmd.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2264 wrote to memory of 2500	2264	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 2292	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
PID 2500 wrote to memory of 1324	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	diskperf.exe
PID 2500 wrote to memory of 1324	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	diskperf.exe
PID 2500 wrote to memory of 1324	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	diskperf.exe
PID 2500 wrote to memory of 1324	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	diskperf.exe
PID 2500 wrote to memory of 1324	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	diskperf.exe
PID 2500 wrote to memory of 1324	2500	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	diskperf.exe
PID 2292 wrote to memory of 2368	2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	explorer.exe
PID 2292 wrote to memory of 2368	2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	explorer.exe
PID 2292 wrote to memory of 2368	2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	explorer.exe
PID 2292 wrote to memory of 2368	2292	10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe	explorer.exe
PID 2368 wrote to memory of 1512	2368	explorer.exe	cmd.exe
PID 2368 wrote to memory of 1512	2368	explorer.exe	cmd.exe
PID 2368 wrote to memory of 1512	2368	explorer.exe	cmd.exe
PID 2368 wrote to memory of 1512	2368	explorer.exe	cmd.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe
PID 2368 wrote to memory of 328	2368	explorer.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
2⤵
- Drops startup file
PID:1616

C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500

C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
5⤵
- Drops startup file
PID:1512

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:328

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1168

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:768

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2792

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
- Executes dropped EXE
PID:2332

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
- Drops startup file
PID:1360

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:1656

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:1588

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1856

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2800

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:1792

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:2892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2544

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2176

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:1860

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3048

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
PID:2128

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 36
12⤵
- Program crash
PID:2132

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:2012

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2836

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2160

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:2524

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:1508

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1496

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1512

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2328

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:376

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
- Drops startup file
PID:2660

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:2504

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:1564

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:672

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1912

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:1628

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:2744

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2940

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:456

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:2760

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
PID:3060

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:2672

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:2384

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2880

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:912

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:3040

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
- Drops startup file
PID:3064

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:1948

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:1420

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2604

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:812

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:932

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:688

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2412

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2644

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:1044

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:2060

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1588

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2944

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:2164

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
- Drops file in Windows directory
PID:932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
- Drops startup file
PID:2472

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:1224

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:964

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1700

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1568

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:2908

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:844

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:608

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:876

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:916

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:3024

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2648

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2064

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2796

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2336

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1372

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2116

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2084

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1732

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2356

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2972

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:800

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1848

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2872

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2576

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2272

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1724

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2468

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2036

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1228

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1792

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2216

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1708

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:288

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1856

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1940

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1640

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1616

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2660

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1740

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1496

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:484

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1864

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2804

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:2344

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1736

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:984

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1448

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1728

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1288

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1988

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1424

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1212

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Drops file in Windows directory
PID:2312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2264

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:2668

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Drops file in Windows directory
PID:2928

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2116

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1304

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
6⤵
PID:2280

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
3⤵
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
10e2dd4f425ef30d4f3fe5ec98a03d5d

SHA1
2e2b1af404c9d6bde505b373c50fc19872c91498

SHA256
794b9a2b8b506360ba92a9a69c40b303b37e43e88ae408db8a1b86c741014968

SHA512
65483b97cf8e46f33700da4e70434f7be3270ab8eacafe1a36a460b2886e3ffa44a4ba4e29f05eeaeee665f0e60990065854fc622866ebe0df422c60c9238047

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
f091f6c032444a84bd2fecbadf1f9bf3

SHA1
a2cb4b03861356cfd6f78b17255886179d45655c

SHA256
bb4f030988bb72a6955d800d2381f35faad3c46ee68fd066e82584353744efd2

SHA512
b3da8818a15c105f1ced79fe50610a0b7ceef6384a6c23ed6851ecca4a79582ba79d2883310ffb82226863e79bf74d1637ec381a28f644b8b36a5e149408c222

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
47a9c41d6f75f7bfa5fb475004eb858c

SHA1
df49c82eccfd646152b364daa0355bbe6a14c5c2

SHA256
376f9f35c0064083fcf8555c8fbf9aa272c3033d6d97a096ef7ca1b0b5745af3

SHA512
021ddc72db8fde0100b46668e2b16a39f8ccbf82865bc8bf47e1d25bb1219ca8dd6337544d3fd5ad59ee298b927d1a9531ee1f744d76fe144641f33d981cb993

Download Submit
memory/328-144-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/328-172-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/456-534-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/456-2091-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/812-640-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/812-2230-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/912-587-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/912-2204-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/916-884-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1168-177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1324-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1324-82-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-73-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1372-1032-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1568-790-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1912-2008-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1912-487-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2160-1868-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2160-385-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2176-1774-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2176-335-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2292-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2292-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2292-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2292-53-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2292-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2328-435-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2328-1894-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2500-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2500-47-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2500-78-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2500-41-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-45-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2500-49-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2500-13-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-17-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-21-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-31-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-40-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2500-46-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-11-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-8-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-10-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-16-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-20-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2500-48-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2500-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-37-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-43-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-23-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-42-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2500-5-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-30-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-25-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2500-27-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2644-693-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2644-2349-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2648-931-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-1589-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-241-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2796-982-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2800-1665-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2800-282-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2944-743-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2944-2434-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download