Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 22:07
Behavioral task
behavioral1
Sample
400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe
-
Size
1.8MB
-
MD5
400760ae7421b03084f7e3a8a8a07850
-
SHA1
280ca6a777b2515172f0b1d5d76e4d6291cd3c55
-
SHA256
7995343b94efec421a8c1a77985387aeee794d60b820f7f28f09e521fece04f9
-
SHA512
f1ac15818e68ad6ce8f252adbfc764446c52011c07857d69745f0ba3d81916a71dfacc52a743dd7943f245fd117b13fc60521ae3a413bb9b41cc87ee440a0525
-
SSDEEP
12288:Q99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSG9dA7W2FeDSIGVH/KIDgM:k1gg4CppEI6GGfWDkMQDbGV6eH8tkH
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\System\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Windows\System\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2120 explorer.exe 4116 explorer.exe 2720 spoolsv.exe 2560 spoolsv.exe 4092 spoolsv.exe 976 spoolsv.exe 1768 spoolsv.exe 2372 spoolsv.exe 3432 spoolsv.exe 4600 spoolsv.exe 3848 spoolsv.exe 2196 spoolsv.exe 1372 spoolsv.exe 3748 spoolsv.exe 3908 spoolsv.exe 836 spoolsv.exe 220 spoolsv.exe 2520 spoolsv.exe 1380 spoolsv.exe 1084 spoolsv.exe 3320 spoolsv.exe 1460 spoolsv.exe 4684 spoolsv.exe 4220 spoolsv.exe 440 spoolsv.exe 3096 spoolsv.exe 4908 spoolsv.exe 1872 spoolsv.exe 3068 spoolsv.exe 1996 spoolsv.exe 3036 spoolsv.exe 4380 spoolsv.exe 1452 spoolsv.exe 3720 spoolsv.exe 4404 spoolsv.exe 3600 spoolsv.exe 4276 spoolsv.exe 1000 spoolsv.exe 2100 spoolsv.exe 644 spoolsv.exe 1012 spoolsv.exe 2448 spoolsv.exe 624 spoolsv.exe 1392 spoolsv.exe 1428 spoolsv.exe 1840 spoolsv.exe 1592 spoolsv.exe 1164 spoolsv.exe 2948 spoolsv.exe 2980 spoolsv.exe 4040 spoolsv.exe 4616 spoolsv.exe 2020 spoolsv.exe 1536 spoolsv.exe 4836 spoolsv.exe 464 spoolsv.exe 4148 spoolsv.exe 628 spoolsv.exe 3548 spoolsv.exe 3576 spoolsv.exe 4216 spoolsv.exe 3264 spoolsv.exe 4332 spoolsv.exe 3876 spoolsv.exe -
Adds Run key to start application 2 TTPs 42 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1556 set thread context of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 2120 set thread context of 4116 2120 explorer.exe explorer.exe PID 2120 set thread context of 1692 2120 explorer.exe diskperf.exe PID 2720 set thread context of 7240 2720 spoolsv.exe spoolsv.exe PID 2560 set thread context of 7360 2560 spoolsv.exe spoolsv.exe PID 2560 set thread context of 7376 2560 spoolsv.exe diskperf.exe PID 4092 set thread context of 7460 4092 spoolsv.exe spoolsv.exe PID 4092 set thread context of 7476 4092 spoolsv.exe diskperf.exe PID 976 set thread context of 7552 976 spoolsv.exe spoolsv.exe PID 976 set thread context of 7568 976 spoolsv.exe diskperf.exe PID 1768 set thread context of 7624 1768 spoolsv.exe spoolsv.exe PID 1768 set thread context of 7636 1768 spoolsv.exe diskperf.exe PID 2372 set thread context of 7720 2372 spoolsv.exe spoolsv.exe PID 2372 set thread context of 7736 2372 spoolsv.exe diskperf.exe PID 3432 set thread context of 7816 3432 spoolsv.exe spoolsv.exe PID 3432 set thread context of 7828 3432 spoolsv.exe diskperf.exe PID 4600 set thread context of 7896 4600 spoolsv.exe spoolsv.exe PID 4600 set thread context of 7908 4600 spoolsv.exe diskperf.exe PID 3848 set thread context of 7988 3848 spoolsv.exe spoolsv.exe PID 3848 set thread context of 8004 3848 spoolsv.exe diskperf.exe PID 2196 set thread context of 8080 2196 spoolsv.exe spoolsv.exe PID 2196 set thread context of 8100 2196 spoolsv.exe diskperf.exe PID 1372 set thread context of 8188 1372 spoolsv.exe spoolsv.exe PID 1372 set thread context of 7248 1372 spoolsv.exe diskperf.exe PID 3748 set thread context of 7252 3748 spoolsv.exe spoolsv.exe PID 3748 set thread context of 4124 3748 spoolsv.exe diskperf.exe PID 3908 set thread context of 7372 3908 spoolsv.exe spoolsv.exe PID 3908 set thread context of 7468 3908 spoolsv.exe diskperf.exe PID 836 set thread context of 7592 836 spoolsv.exe spoolsv.exe PID 836 set thread context of 7472 836 spoolsv.exe diskperf.exe PID 220 set thread context of 1136 220 spoolsv.exe spoolsv.exe PID 220 set thread context of 7696 220 spoolsv.exe diskperf.exe PID 2520 set thread context of 7844 2520 spoolsv.exe spoolsv.exe PID 2520 set thread context of 7848 2520 spoolsv.exe diskperf.exe PID 1380 set thread context of 7936 1380 spoolsv.exe spoolsv.exe PID 1380 set thread context of 7952 1380 spoolsv.exe diskperf.exe PID 1084 set thread context of 8024 1084 spoolsv.exe spoolsv.exe PID 1084 set thread context of 7992 1084 spoolsv.exe diskperf.exe PID 3320 set thread context of 8164 3320 spoolsv.exe spoolsv.exe PID 3320 set thread context of 8180 3320 spoolsv.exe diskperf.exe PID 1460 set thread context of 2212 1460 spoolsv.exe spoolsv.exe PID 1460 set thread context of 8188 1460 spoolsv.exe diskperf.exe PID 4684 set thread context of 2480 4684 spoolsv.exe spoolsv.exe PID 4684 set thread context of 7564 4684 spoolsv.exe diskperf.exe PID 4220 set thread context of 7664 4220 spoolsv.exe spoolsv.exe PID 4220 set thread context of 7548 4220 spoolsv.exe diskperf.exe PID 440 set thread context of 7760 440 spoolsv.exe spoolsv.exe PID 440 set thread context of 7864 440 spoolsv.exe diskperf.exe PID 3096 set thread context of 7924 3096 spoolsv.exe spoolsv.exe PID 3096 set thread context of 7948 3096 spoolsv.exe diskperf.exe PID 4908 set thread context of 8092 4908 spoolsv.exe spoolsv.exe PID 4908 set thread context of 2380 4908 spoolsv.exe diskperf.exe PID 1872 set thread context of 7292 1872 spoolsv.exe spoolsv.exe PID 1872 set thread context of 1420 1872 spoolsv.exe diskperf.exe PID 3068 set thread context of 3992 3068 spoolsv.exe spoolsv.exe PID 3068 set thread context of 2776 3068 spoolsv.exe diskperf.exe PID 1996 set thread context of 3016 1996 spoolsv.exe spoolsv.exe PID 1996 set thread context of 1808 1996 spoolsv.exe diskperf.exe PID 3036 set thread context of 7576 3036 spoolsv.exe spoolsv.exe PID 3036 set thread context of 1636 3036 spoolsv.exe diskperf.exe PID 4380 set thread context of 1732 4380 spoolsv.exe spoolsv.exe PID 4380 set thread context of 7984 4380 spoolsv.exe diskperf.exe PID 1452 set thread context of 2400 1452 spoolsv.exe spoolsv.exe PID 1452 set thread context of 2832 1452 spoolsv.exe diskperf.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exespoolsv.exe400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exeexplorer.exepid process 2676 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 2676 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4116 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2676 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 2676 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 7240 spoolsv.exe 7240 spoolsv.exe 7360 spoolsv.exe 7360 spoolsv.exe 7460 spoolsv.exe 7460 spoolsv.exe 7552 spoolsv.exe 7552 spoolsv.exe 7624 spoolsv.exe 7624 spoolsv.exe 7720 spoolsv.exe 7720 spoolsv.exe 7816 spoolsv.exe 7816 spoolsv.exe 7896 spoolsv.exe 7896 spoolsv.exe 7988 spoolsv.exe 7988 spoolsv.exe 8080 spoolsv.exe 8080 spoolsv.exe 8188 spoolsv.exe 8188 spoolsv.exe 7252 spoolsv.exe 7252 spoolsv.exe 7372 spoolsv.exe 7372 spoolsv.exe 7592 spoolsv.exe 7592 spoolsv.exe 1136 spoolsv.exe 1136 spoolsv.exe 7844 spoolsv.exe 7844 spoolsv.exe 7936 spoolsv.exe 7936 spoolsv.exe 8024 spoolsv.exe 8024 spoolsv.exe 8164 spoolsv.exe 8164 spoolsv.exe 2212 spoolsv.exe 2212 spoolsv.exe 2480 spoolsv.exe 2480 spoolsv.exe 7664 spoolsv.exe 7664 spoolsv.exe 7760 spoolsv.exe 7760 spoolsv.exe 7924 spoolsv.exe 7924 spoolsv.exe 8092 spoolsv.exe 8092 spoolsv.exe 7292 spoolsv.exe 7292 spoolsv.exe 3992 spoolsv.exe 3992 spoolsv.exe 3016 spoolsv.exe 3016 spoolsv.exe 7576 spoolsv.exe 7576 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exeexplorer.exeexplorer.exedescription pid process target process PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 2676 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe PID 1556 wrote to memory of 1484 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe diskperf.exe PID 1556 wrote to memory of 1484 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe diskperf.exe PID 1556 wrote to memory of 1484 1556 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe diskperf.exe PID 2676 wrote to memory of 2120 2676 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe explorer.exe PID 2676 wrote to memory of 2120 2676 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe explorer.exe PID 2676 wrote to memory of 2120 2676 400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 4116 2120 explorer.exe explorer.exe PID 2120 wrote to memory of 1692 2120 explorer.exe diskperf.exe PID 2120 wrote to memory of 1692 2120 explorer.exe diskperf.exe PID 2120 wrote to memory of 1692 2120 explorer.exe diskperf.exe PID 2120 wrote to memory of 1692 2120 explorer.exe diskperf.exe PID 2120 wrote to memory of 1692 2120 explorer.exe diskperf.exe PID 4116 wrote to memory of 2720 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2720 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2720 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2560 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2560 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2560 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 4092 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 4092 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 4092 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 976 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 976 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 976 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 1768 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 1768 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 1768 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2372 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2372 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2372 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3432 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3432 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3432 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 4600 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 4600 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 4600 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3848 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3848 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3848 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2196 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2196 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 2196 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 1372 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 1372 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 1372 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3748 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3748 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3748 4116 explorer.exe spoolsv.exe PID 4116 wrote to memory of 3908 4116 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\400760ae7421b03084f7e3a8a8a07850_NeikiAnalytics.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeFilesize
1.8MB
MD5400760ae7421b03084f7e3a8a8a07850
SHA1280ca6a777b2515172f0b1d5d76e4d6291cd3c55
SHA2567995343b94efec421a8c1a77985387aeee794d60b820f7f28f09e521fece04f9
SHA512f1ac15818e68ad6ce8f252adbfc764446c52011c07857d69745f0ba3d81916a71dfacc52a743dd7943f245fd117b13fc60521ae3a413bb9b41cc87ee440a0525
-
C:\Windows\System\explorer.exeFilesize
1.8MB
MD582373c8bf058477d3716f8911250f59f
SHA106fa6a028395bd413958d842667fb7443016cbe6
SHA2569235c9b6d15686f6a7458130acaea70f0b437709ed0ae179e8fa5f353e7ee909
SHA51221b954f990153e1a07f47cabaf72023798f2e04ebf4585f93a18e9008e2a445906d7a2f756699657349cca474eaad67814041343cd677fb683f024903d95a389
-
C:\Windows\System\spoolsv.exeFilesize
1.8MB
MD54b60365eaa11579371bc44f02ba80966
SHA11785e5e928c07c796125648b36d7076dff8fd8a4
SHA256fe231a9c2b92f7513368bca48adf44f325e54bd1bf8f346ee21185d5fe8b7e06
SHA5126882db6dc753fb08d55b7da4954015acb96c6ef13ed3975da04100d8dfb3ca087c1a56eaf4e6501542ae60e4e54712cdec5c64861d8e0de44944498bac7064cc
-
memory/220-92-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/440-108-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/464-157-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/464-177-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/624-149-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/628-181-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/644-121-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/644-143-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/680-180-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/836-90-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/976-69-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1000-139-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1012-145-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1084-98-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1092-176-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1096-188-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1164-161-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1200-184-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1372-63-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1372-83-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1380-96-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1392-151-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1428-154-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1428-132-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1452-127-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1460-102-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1536-173-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1536-152-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1556-0-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1556-3-0x00000000007E0000-0x00000000007E1000-memory.dmpFilesize
4KB
-
memory/1556-13-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1556-1-0x00000000007E0000-0x00000000007E1000-memory.dmpFilesize
4KB
-
memory/1556-2-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1592-159-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1692-37-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1692-34-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1692-43-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1768-71-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1840-156-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1840-135-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1872-115-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1996-120-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2020-171-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2100-118-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2100-141-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2120-19-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2120-40-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2120-23-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2196-81-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2372-73-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2448-147-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2520-94-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2528-178-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2560-65-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2560-51-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2676-4-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2676-8-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2676-22-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2676-20-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/2720-49-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2720-62-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2948-163-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/2980-165-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3036-123-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3068-117-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3084-186-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3096-110-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3264-170-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3264-189-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3320-100-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3428-182-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3432-75-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3548-183-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3576-185-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3576-166-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3600-134-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3720-129-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3748-85-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3848-79-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3876-174-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/3908-88-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4040-167-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4092-67-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4116-59-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4116-32-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4148-179-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4216-168-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4216-187-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4220-106-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4220-86-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4276-137-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4332-172-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4332-192-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4380-125-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4404-131-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4600-77-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4616-169-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4684-104-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4836-175-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4844-190-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/4908-112-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/7240-250-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7360-260-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7460-269-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7552-278-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7624-288-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7720-307-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7816-308-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7896-318-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7988-327-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB