Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 21:57
Behavioral task
behavioral1
Sample
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe
Resource
win10v2004-20240508-en
General
-
Target
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe
-
Size
2.9MB
-
MD5
6431f37946abfa89e940fa27fe6c3718
-
SHA1
2eba6e19326c672869e4e4b00f0086668e3bea12
-
SHA256
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1
-
SHA512
6338e1894662d1414f849d5096b317e890abeedfd59a2bd20de4204dc23d1b1bbd4595abf175cdaae846bd502e0f49943a7285eb2ccf61465370b88b3a3cbbc7
-
SSDEEP
49152:7v97AXmw4gxeOw46fUbNecCCFbNecZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKe:7v97K9xZw46G8q8Q
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects executables packed with ASPack 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3712-1-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-5-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-4-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-8-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-6-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-3-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-2-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-7-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-10-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-28-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3712-25-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-45-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-42-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-44-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-43-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-46-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-47-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-51-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-64-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-67-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2920-86-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2920-83-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2920-82-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2920-85-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2920-84-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2920-81-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-98-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-96-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-100-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-97-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-95-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-99-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-108-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-111-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-109-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-110-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-107-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-112-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3736-124-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5072-137-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5024-150-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1708-162-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3684-175-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/464-187-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4192-200-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1568-212-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2936-226-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3664-239-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3624-251-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1696-266-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1192-280-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4556-294-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2124-304-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1832-319-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1580-331-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2580-343-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4592-353-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4932-364-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1828-376-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4076-386-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4860-398-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1052-409-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2140-419-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-479-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack -
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\System\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \??\c:\windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 30 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1088 explorer.exe 2524 explorer.exe 4968 explorer.exe 3756 spoolsv.exe 2920 spoolsv.exe 388 spoolsv.exe 3260 spoolsv.exe 1584 spoolsv.exe 1220 spoolsv.exe 3508 spoolsv.exe 3736 spoolsv.exe 3332 spoolsv.exe 5072 spoolsv.exe 3472 spoolsv.exe 5024 spoolsv.exe 3972 spoolsv.exe 1708 spoolsv.exe 2232 spoolsv.exe 3684 spoolsv.exe 4500 spoolsv.exe 464 spoolsv.exe 4580 spoolsv.exe 4192 spoolsv.exe 1192 spoolsv.exe 1568 spoolsv.exe 2636 spoolsv.exe 2936 spoolsv.exe 232 spoolsv.exe 3664 spoolsv.exe 384 spoolsv.exe 3624 spoolsv.exe 1968 spoolsv.exe 1696 spoolsv.exe 1436 spoolsv.exe 1192 spoolsv.exe 2564 spoolsv.exe 4556 spoolsv.exe 2888 spoolsv.exe 2124 spoolsv.exe 4868 spoolsv.exe 1832 spoolsv.exe 1940 spoolsv.exe 1580 spoolsv.exe 5092 spoolsv.exe 2580 spoolsv.exe 1628 spoolsv.exe 4592 spoolsv.exe 628 spoolsv.exe 4932 spoolsv.exe 3620 spoolsv.exe 1828 spoolsv.exe 3996 spoolsv.exe 4076 spoolsv.exe 2796 spoolsv.exe 4860 spoolsv.exe 2136 spoolsv.exe 1052 spoolsv.exe 4584 spoolsv.exe 3800 spoolsv.exe 1400 spoolsv.exe 2216 spoolsv.exe 3092 spoolsv.exe 3536 spoolsv.exe 2272 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exeexplorer.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 34 IoCs
Processes:
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2464 set thread context of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 set thread context of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 set thread context of 876 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe diskperf.exe PID 1088 set thread context of 2524 1088 explorer.exe explorer.exe PID 2524 set thread context of 4968 2524 explorer.exe explorer.exe PID 2524 set thread context of 960 2524 explorer.exe diskperf.exe PID 3756 set thread context of 2920 3756 spoolsv.exe spoolsv.exe PID 388 set thread context of 3260 388 spoolsv.exe spoolsv.exe PID 1584 set thread context of 1220 1584 spoolsv.exe spoolsv.exe PID 3508 set thread context of 3736 3508 spoolsv.exe spoolsv.exe PID 3332 set thread context of 5072 3332 spoolsv.exe spoolsv.exe PID 3472 set thread context of 5024 3472 spoolsv.exe spoolsv.exe PID 3972 set thread context of 1708 3972 spoolsv.exe spoolsv.exe PID 2232 set thread context of 3684 2232 spoolsv.exe spoolsv.exe PID 4500 set thread context of 464 4500 spoolsv.exe spoolsv.exe PID 4580 set thread context of 4192 4580 spoolsv.exe spoolsv.exe PID 1192 set thread context of 1568 1192 spoolsv.exe spoolsv.exe PID 2636 set thread context of 2936 2636 spoolsv.exe spoolsv.exe PID 232 set thread context of 3664 232 spoolsv.exe spoolsv.exe PID 384 set thread context of 3624 384 spoolsv.exe spoolsv.exe PID 1968 set thread context of 1696 1968 spoolsv.exe spoolsv.exe PID 1436 set thread context of 1192 1436 spoolsv.exe spoolsv.exe PID 2564 set thread context of 4556 2564 spoolsv.exe spoolsv.exe PID 2888 set thread context of 2124 2888 spoolsv.exe spoolsv.exe PID 4868 set thread context of 1832 4868 spoolsv.exe spoolsv.exe PID 1940 set thread context of 1580 1940 spoolsv.exe spoolsv.exe PID 5092 set thread context of 2580 5092 spoolsv.exe spoolsv.exe PID 1628 set thread context of 4592 1628 spoolsv.exe spoolsv.exe PID 628 set thread context of 4932 628 spoolsv.exe spoolsv.exe PID 3620 set thread context of 1828 3620 spoolsv.exe spoolsv.exe PID 3996 set thread context of 4076 3996 spoolsv.exe spoolsv.exe PID 2796 set thread context of 4860 2796 spoolsv.exe spoolsv.exe PID 2136 set thread context of 1052 2136 spoolsv.exe spoolsv.exe PID 4584 set thread context of 2140 4584 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 32 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3428 2796 WerFault.exe spoolsv.exe 4868 1968 WerFault.exe spoolsv.exe -
Modifies data under HKEY_USERS 18 IoCs
Processes:
dwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 772 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 772 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 1088 explorer.exe 1088 explorer.exe 3756 spoolsv.exe 3756 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 388 spoolsv.exe 388 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 1584 spoolsv.exe 1584 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 3508 spoolsv.exe 3508 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 3332 spoolsv.exe 3332 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 3472 spoolsv.exe 3472 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 3972 spoolsv.exe 3972 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 2232 spoolsv.exe 2232 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 4500 spoolsv.exe 4500 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 4580 spoolsv.exe 4580 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 1192 spoolsv.exe 1192 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 2636 spoolsv.exe 2636 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 232 spoolsv.exe 232 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 384 spoolsv.exe 384 spoolsv.exe 4968 explorer.exe 4968 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
dwm.exedescription pid process Token: SeCreateGlobalPrivilege 4368 dwm.exe Token: SeChangeNotifyPrivilege 4368 dwm.exe Token: 33 4368 dwm.exe Token: SeIncBasePriorityPrivilege 4368 dwm.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 772 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 772 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 1088 explorer.exe 1088 explorer.exe 4968 explorer.exe 4968 explorer.exe 3756 spoolsv.exe 3756 spoolsv.exe 4968 explorer.exe 4968 explorer.exe 388 spoolsv.exe 388 spoolsv.exe 1584 spoolsv.exe 1584 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 3472 spoolsv.exe 3472 spoolsv.exe 3972 spoolsv.exe 3972 spoolsv.exe 2232 spoolsv.exe 2232 spoolsv.exe 4500 spoolsv.exe 4500 spoolsv.exe 4580 spoolsv.exe 4580 spoolsv.exe 1192 spoolsv.exe 1192 spoolsv.exe 2636 spoolsv.exe 2636 spoolsv.exe 232 spoolsv.exe 232 spoolsv.exe 384 spoolsv.exe 384 spoolsv.exe 1968 spoolsv.exe 1968 spoolsv.exe 1436 spoolsv.exe 1436 spoolsv.exe 2564 spoolsv.exe 2564 spoolsv.exe 2888 spoolsv.exe 2888 spoolsv.exe 4868 spoolsv.exe 4868 spoolsv.exe 1940 spoolsv.exe 1940 spoolsv.exe 5092 spoolsv.exe 5092 spoolsv.exe 1628 spoolsv.exe 1628 spoolsv.exe 628 spoolsv.exe 628 spoolsv.exe 3620 spoolsv.exe 3620 spoolsv.exe 3996 spoolsv.exe 3996 spoolsv.exe 2796 spoolsv.exe 2796 spoolsv.exe 2136 spoolsv.exe 2136 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exeexplorer.exedescription pid process target process PID 2464 wrote to memory of 2372 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe cmd.exe PID 2464 wrote to memory of 2372 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe cmd.exe PID 2464 wrote to memory of 2372 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe cmd.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 2464 wrote to memory of 3712 2464 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 772 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe PID 3712 wrote to memory of 876 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe diskperf.exe PID 3712 wrote to memory of 876 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe diskperf.exe PID 3712 wrote to memory of 876 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe diskperf.exe PID 3712 wrote to memory of 876 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe diskperf.exe PID 3712 wrote to memory of 876 3712 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe diskperf.exe PID 772 wrote to memory of 1088 772 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe explorer.exe PID 772 wrote to memory of 1088 772 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe explorer.exe PID 772 wrote to memory of 1088 772 58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe explorer.exe PID 1088 wrote to memory of 1556 1088 explorer.exe cmd.exe PID 1088 wrote to memory of 1556 1088 explorer.exe cmd.exe PID 1088 wrote to memory of 1556 1088 explorer.exe cmd.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 2524 1088 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe"C:\Users\Admin\AppData\Local\Temp\58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exeC:\Users\Admin\AppData\Local\Temp\58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exeC:\Users\Admin\AppData\Local\Temp\58502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 5648⤵
- Program crash
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 4008⤵
- Program crash
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1336,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:81⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1968 -ip 19681⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeFilesize
2.9MB
MD56431f37946abfa89e940fa27fe6c3718
SHA12eba6e19326c672869e4e4b00f0086668e3bea12
SHA25658502a3a0c1f7926c1b5cc45699515a2c99157cf3ddaf45e5468a946695b3ff1
SHA5126338e1894662d1414f849d5096b317e890abeedfd59a2bd20de4204dc23d1b1bbd4595abf175cdaae846bd502e0f49943a7285eb2ccf61465370b88b3a3cbbc7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
C:\Windows\System\explorer.exeFilesize
2.9MB
MD54803de5acc69fd0b59dfc5152b6cb2fa
SHA1b706033fd42ddb8fe9b4646e16e694a54be5e472
SHA2566665eaf3560a19773fd9205c052aa500dd7b7625fa4fe9bc7b8fc785139fde25
SHA5129aa16962a3cdaeefefd301a275465c187dc299ec7bd144e5eea20c0d4a03a6259636209ce736a111004b85b498172cce0dc47192cd56fe92f831ff49825172cc
-
\??\c:\windows\system\spoolsv.exeFilesize
2.9MB
MD508b8512b8eb6730693a9fff2d92ff0ca
SHA1648f7b11db1044db9293e04634b6b5b16fca1f9a
SHA256ada7957a5c54412140611a0013989f66761731ce7f41bc00daf0b67cb3c6ca86
SHA51221beae11165186f5b14e4ea615e1be33f2dd74c89458104de0cdc0d161e5b8cc97a9f03603ab550f195eca2385d5d198b26b28a88966f6e7947a9ba74e24cb72
-
memory/464-187-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/464-606-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/772-50-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/772-16-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/772-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/876-26-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/876-24-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/876-21-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1052-409-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1192-280-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1220-107-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1220-110-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1220-108-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1220-111-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1220-112-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1220-109-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1220-479-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1568-212-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1580-331-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1588-603-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1696-266-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1708-560-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1708-162-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1828-376-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1832-319-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2124-304-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2140-419-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2524-43-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2524-44-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2524-42-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2524-46-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2524-47-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2524-51-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2524-64-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2524-67-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2524-45-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2580-343-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2872-490-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2920-83-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2920-506-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2920-86-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2920-81-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2920-84-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2920-85-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2920-82-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2936-226-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3260-100-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3260-98-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3260-96-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3260-97-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3260-533-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3260-99-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3260-95-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3428-543-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3536-557-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3624-251-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3656-536-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3664-239-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3684-582-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3684-175-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3712-28-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3712-4-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3712-7-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3712-13-0x00000000004E7000-0x0000000000513000-memory.dmpFilesize
176KB
-
memory/3712-9-0x00000000004E7000-0x0000000000513000-memory.dmpFilesize
176KB
-
memory/3712-5-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3712-2-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3712-1-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3712-10-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3712-3-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3712-6-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3712-8-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3712-25-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3736-124-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3736-503-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/4076-386-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/4192-200-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/4324-578-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4380-593-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/4528-521-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4552-476-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4552-553-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4556-294-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/4592-353-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/4668-572-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/4860-398-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/4932-364-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/5024-518-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/5024-150-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/5072-137-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/5092-508-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB