Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 21:34
Behavioral task
behavioral1
Sample
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe
Resource
win10v2004-20240419-en
General
-
Target
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe
-
Size
2.9MB
-
MD5
6152aa2ac9f13e528d29264bacfafcc5
-
SHA1
e96252bddfcd18be20123d26d5224e6b4014cea2
-
SHA256
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b
-
SHA512
c191d41a948d90d9ba1165cc23509c9ed94c3a022edbb69380b0b9c71ab57dd224126784a1d4ba0d241ad06e2bfee5d43a58ab8fc517f1342b39cddc172d203d
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHG:7v97AXmw4gxeOw46fUbNecCCFbNecT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects executables packed with ASPack 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3720-5-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-2-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-6-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-7-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-4-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-1-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-3-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-8-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-10-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-11-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-23-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3720-26-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-43-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-46-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-42-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-45-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-44-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-41-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-50-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-64-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2272-70-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4884-80-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4884-83-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4884-84-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4884-81-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4884-82-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4884-79-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2192-94-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2192-95-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2192-93-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2192-98-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2192-96-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2192-97-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1632-108-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-118-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-116-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-120-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-115-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3096-133-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3972-146-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3220-158-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4076-171-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2992-183-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3968-195-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3940-208-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4864-221-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4136-235-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/632-249-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1748-262-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3160-276-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/808-289-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3700-302-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/784-316-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4140-327-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4020-339-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3944-349-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3384-360-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2012-372-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1324-383-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3216-394-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3612-406-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/880-427-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1028-440-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4312-451-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack -
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\System\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Windows\System\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 35 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4044 explorer.exe 2272 explorer.exe 3824 explorer.exe 2156 spoolsv.exe 4884 spoolsv.exe 4440 spoolsv.exe 2192 spoolsv.exe 3480 spoolsv.exe 1632 spoolsv.exe 1016 spoolsv.exe 3260 spoolsv.exe 2900 spoolsv.exe 3096 spoolsv.exe 4676 spoolsv.exe 3972 spoolsv.exe 4916 spoolsv.exe 3220 spoolsv.exe 2016 spoolsv.exe 4076 spoolsv.exe 2640 spoolsv.exe 2992 spoolsv.exe 4648 spoolsv.exe 3968 spoolsv.exe 4212 spoolsv.exe 3940 spoolsv.exe 4824 spoolsv.exe 4864 spoolsv.exe 1016 spoolsv.exe 4136 spoolsv.exe 4204 spoolsv.exe 632 spoolsv.exe 2244 spoolsv.exe 1748 spoolsv.exe 3508 spoolsv.exe 3160 spoolsv.exe 4192 spoolsv.exe 808 spoolsv.exe 2140 spoolsv.exe 3700 spoolsv.exe 4528 spoolsv.exe 784 spoolsv.exe 1280 spoolsv.exe 4140 spoolsv.exe 1220 spoolsv.exe 4020 spoolsv.exe 1100 spoolsv.exe 3944 spoolsv.exe 1392 spoolsv.exe 3384 spoolsv.exe 3484 spoolsv.exe 2012 spoolsv.exe 1644 spoolsv.exe 1324 spoolsv.exe 916 spoolsv.exe 3216 spoolsv.exe 2152 spoolsv.exe 3612 spoolsv.exe 4436 spoolsv.exe 4176 spoolsv.exe 4660 spoolsv.exe 1220 spoolsv.exe 4496 spoolsv.exe 4520 spoolsv.exe 4544 spoolsv.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 43 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1020 set thread context of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 set thread context of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 set thread context of 2068 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 4044 set thread context of 2272 4044 explorer.exe explorer.exe PID 2272 set thread context of 3824 2272 explorer.exe explorer.exe PID 2272 set thread context of 4392 2272 explorer.exe diskperf.exe PID 2156 set thread context of 4884 2156 spoolsv.exe spoolsv.exe PID 4440 set thread context of 2192 4440 spoolsv.exe spoolsv.exe PID 3480 set thread context of 1632 3480 spoolsv.exe spoolsv.exe PID 1016 set thread context of 3260 1016 spoolsv.exe spoolsv.exe PID 2900 set thread context of 3096 2900 spoolsv.exe spoolsv.exe PID 4676 set thread context of 3972 4676 spoolsv.exe spoolsv.exe PID 4916 set thread context of 3220 4916 spoolsv.exe spoolsv.exe PID 2016 set thread context of 4076 2016 spoolsv.exe spoolsv.exe PID 2640 set thread context of 2992 2640 spoolsv.exe spoolsv.exe PID 4648 set thread context of 3968 4648 spoolsv.exe spoolsv.exe PID 4212 set thread context of 3940 4212 spoolsv.exe spoolsv.exe PID 4824 set thread context of 4864 4824 spoolsv.exe spoolsv.exe PID 1016 set thread context of 4136 1016 spoolsv.exe spoolsv.exe PID 4204 set thread context of 632 4204 spoolsv.exe spoolsv.exe PID 2244 set thread context of 1748 2244 spoolsv.exe spoolsv.exe PID 3508 set thread context of 3160 3508 spoolsv.exe spoolsv.exe PID 4192 set thread context of 808 4192 spoolsv.exe spoolsv.exe PID 2140 set thread context of 3700 2140 spoolsv.exe spoolsv.exe PID 4528 set thread context of 784 4528 spoolsv.exe spoolsv.exe PID 1280 set thread context of 4140 1280 spoolsv.exe spoolsv.exe PID 1220 set thread context of 4020 1220 spoolsv.exe spoolsv.exe PID 1100 set thread context of 3944 1100 spoolsv.exe spoolsv.exe PID 1392 set thread context of 3384 1392 spoolsv.exe spoolsv.exe PID 3484 set thread context of 2012 3484 spoolsv.exe spoolsv.exe PID 1644 set thread context of 1324 1644 spoolsv.exe spoolsv.exe PID 916 set thread context of 3216 916 spoolsv.exe spoolsv.exe PID 2152 set thread context of 3612 2152 spoolsv.exe spoolsv.exe PID 4436 set thread context of 4176 4436 spoolsv.exe spoolsv.exe PID 3008 set thread context of 1028 3008 spoolsv.exe spoolsv.exe PID 5076 set thread context of 4312 5076 spoolsv.exe spoolsv.exe PID 3344 set thread context of 2284 3344 spoolsv.exe spoolsv.exe PID 3516 set thread context of 3168 3516 spoolsv.exe spoolsv.exe PID 4124 set thread context of 4304 4124 spoolsv.exe spoolsv.exe PID 2192 set thread context of 1996 2192 spoolsv.exe spoolsv.exe PID 2192 set thread context of 5072 2192 spoolsv.exe diskperf.exe PID 1632 set thread context of 3516 1632 spoolsv.exe spoolsv.exe PID 3220 set thread context of 540 3220 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 39 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1908 3436 WerFault.exe spoolsv.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dwm.exedwm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
dwm.exedwm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 36 IoCs
Processes:
dwm.exedwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4444 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4444 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4044 explorer.exe 4044 explorer.exe 2156 spoolsv.exe 2156 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 4440 spoolsv.exe 4440 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 3480 spoolsv.exe 3480 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 1016 spoolsv.exe 1016 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 2900 spoolsv.exe 2900 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 4676 spoolsv.exe 4676 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 4916 spoolsv.exe 4916 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 2016 spoolsv.exe 2016 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 2640 spoolsv.exe 2640 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 4648 spoolsv.exe 4648 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 4212 spoolsv.exe 4212 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 4824 spoolsv.exe 4824 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 1016 spoolsv.exe 1016 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 4204 spoolsv.exe 4204 spoolsv.exe 3824 explorer.exe 3824 explorer.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
dwm.exedwm.exedescription pid process Token: SeCreateGlobalPrivilege 4360 dwm.exe Token: SeChangeNotifyPrivilege 4360 dwm.exe Token: 33 4360 dwm.exe Token: SeIncBasePriorityPrivilege 4360 dwm.exe Token: SeCreateGlobalPrivilege 912 dwm.exe Token: SeChangeNotifyPrivilege 912 dwm.exe Token: 33 912 dwm.exe Token: SeIncBasePriorityPrivilege 912 dwm.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4444 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4444 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4044 explorer.exe 4044 explorer.exe 3824 explorer.exe 3824 explorer.exe 2156 spoolsv.exe 2156 spoolsv.exe 3824 explorer.exe 3824 explorer.exe 4440 spoolsv.exe 4440 spoolsv.exe 3480 spoolsv.exe 3480 spoolsv.exe 1016 spoolsv.exe 1016 spoolsv.exe 2900 spoolsv.exe 2900 spoolsv.exe 4676 spoolsv.exe 4676 spoolsv.exe 4916 spoolsv.exe 4916 spoolsv.exe 2016 spoolsv.exe 2016 spoolsv.exe 2640 spoolsv.exe 2640 spoolsv.exe 4648 spoolsv.exe 4648 spoolsv.exe 4212 spoolsv.exe 4212 spoolsv.exe 4824 spoolsv.exe 4824 spoolsv.exe 1016 spoolsv.exe 1016 spoolsv.exe 4204 spoolsv.exe 4204 spoolsv.exe 2244 spoolsv.exe 2244 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 4192 spoolsv.exe 4192 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 4528 spoolsv.exe 4528 spoolsv.exe 1280 spoolsv.exe 1280 spoolsv.exe 1220 spoolsv.exe 1220 spoolsv.exe 1100 spoolsv.exe 1100 spoolsv.exe 1392 spoolsv.exe 1392 spoolsv.exe 3484 spoolsv.exe 3484 spoolsv.exe 1644 spoolsv.exe 1644 spoolsv.exe 916 spoolsv.exe 916 spoolsv.exe 2152 spoolsv.exe 2152 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exedescription pid process target process PID 1020 wrote to memory of 4340 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe cmd.exe PID 1020 wrote to memory of 4340 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe cmd.exe PID 1020 wrote to memory of 4340 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe cmd.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1020 wrote to memory of 3720 1020 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 4444 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 3720 wrote to memory of 2068 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 3720 wrote to memory of 2068 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 3720 wrote to memory of 2068 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 3720 wrote to memory of 2068 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 3720 wrote to memory of 2068 3720 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 4444 wrote to memory of 4044 4444 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe explorer.exe PID 4444 wrote to memory of 4044 4444 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe explorer.exe PID 4444 wrote to memory of 4044 4444 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe explorer.exe PID 4044 wrote to memory of 3260 4044 explorer.exe cmd.exe PID 4044 wrote to memory of 3260 4044 explorer.exe cmd.exe PID 4044 wrote to memory of 3260 4044 explorer.exe cmd.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe PID 4044 wrote to memory of 2272 4044 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe"C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeC:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeC:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:3260 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2272 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3824 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:620
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2192 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1996
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2428
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:5060
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:5072
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1632 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:3516
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:5016 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3260 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2216
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3096 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:5044
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3268
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4512 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3972 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1020
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3508 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:3220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:540
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:4516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4076 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:4952
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:3704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2880
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1768
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:4192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2992 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2228
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1412 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:632 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:808 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:784 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2180 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4140 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:5060 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4364 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3384 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4624 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4976 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3612 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1372 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4176 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4496 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4520 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4544 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1144
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3716
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1412
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4712
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4920
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2404
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4676
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2168
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3164
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4472
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:664
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2440
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4184
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2160
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4468
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4728
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3964
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1552
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:912
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4720
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4332
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4360
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3168
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4628
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1380
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2128
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4084
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4412
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3900
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:8
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2284
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4772
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:992
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2244
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:552
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3424
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4296
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4784
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4472
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:664
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2440
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4016
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4664
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2180
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4612
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4356
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1536
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2816
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4496
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1144
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3716
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1412
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4712
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4920
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2404
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4676
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3164
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2168
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4312
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2640
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1552
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2216
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3728
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4776
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3268
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3744
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4964
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4728
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4016
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5016
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4332
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4360
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3168
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4628
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1380
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2128
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4084
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4412
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3900
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:8
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2284
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4916 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4784
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:664
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4468
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1296
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4860
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3964
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4148
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2160
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2140
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2640
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1552
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2216
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3728
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4776
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3268
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3744
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4964
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4728
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4016
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5016
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4332
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4360
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3168
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4412
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3900
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:8
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2404
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4376
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4676
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4296
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4472
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3556
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4840
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4624
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:912
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3672
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4596
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4704
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2356
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3816
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1236
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3416
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1152
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1188
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4212
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1924
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3752
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 5528⤵
- Program crash
PID:1908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4184
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4084
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:4392
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:2068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3436 -ip 34361⤵PID:2828
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3484
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4668
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD56152aa2ac9f13e528d29264bacfafcc5
SHA1e96252bddfcd18be20123d26d5224e6b4014cea2
SHA2564c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b
SHA512c191d41a948d90d9ba1165cc23509c9ed94c3a022edbb69380b0b9c71ab57dd224126784a1d4ba0d241ad06e2bfee5d43a58ab8fc517f1342b39cddc172d203d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD56c4b2d2eb331e4aa66c92b3bf113e9ad
SHA1fb55b69eb7e3f038600d41f990c05da65aa55583
SHA25600209c3aa053d263e86132cb610f8c3685cffabd228a920cc99aad530e241dde
SHA5125e6a6d4296abb2fc0b7a3bf823c1af887ce797677180b3f21048558aba60e13c74caf6a074ab1c95664f74e07609a0b4cd6a832af831a46ddaf2a9ef44c13f81
-
Filesize
2.9MB
MD5c348ebde82aa5f7b583e1b52a6f83dc5
SHA1153f7317cb975e4ea36add526fd810d52dccdd08
SHA256b8103f8ff4625ee733ad87e3133d4662ed113c1d6723687d28b7ef9734f77776
SHA512a4b3d26897f73ee53de7a8342a84335f90a2d1f6c0d2e424c045952bbaa7a68b8dddddc217fa2e59bdb9c3cefb4230bf3ae6093b8772b47b99940bf76591e34f