warzonerat | 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7

Analysis

max time kernel
118s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
Size

2.9MB
MD5

114a26070e503bb2959c8cf89beccd10
SHA1

8b6c92b087d0e365db42f0b3db92b61f86e5b139
SHA256

830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7
SHA512

8d6bc52a2d0925fe2abb4f35f1602c01cd3782d8cdbdfada66164e5abb030ed6347fe0c222f2e3a07afb9510e1a61e76c72895e72aa766939a95e4d7283731d6
SSDEEP

24576:bTO7AsmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHb:bTO7Asmw4gxeOw46fUbNecCCFbNec+

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x0008000000016c62-86.dat	warzonerat
behavioral1/files/0x000800000001662e-164.dat	warzonerat
behavioral1/files/0x0008000000016c7b-181.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 15 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 47 IoCs

pid	Process
2584	explorer.exe
2324	explorer.exe
900	explorer.exe
1860	spoolsv.exe
2628	spoolsv.exe
1296	spoolsv.exe
1592	spoolsv.exe
2808	spoolsv.exe
2700	spoolsv.exe
2944	spoolsv.exe
2756	spoolsv.exe
2884	spoolsv.exe
2320	spoolsv.exe
2196	spoolsv.exe
812	spoolsv.exe
1660	spoolsv.exe
3028	spoolsv.exe
1088	spoolsv.exe
2300	spoolsv.exe
2816	spoolsv.exe
2548	spoolsv.exe
1076	spoolsv.exe
1788	spoolsv.exe
2140	spoolsv.exe
2356	spoolsv.exe
3040	spoolsv.exe
2644	spoolsv.exe
700	spoolsv.exe
2984	spoolsv.exe
1328	spoolsv.exe
1920	spoolsv.exe
2724	spoolsv.exe
664	spoolsv.exe
808	spoolsv.exe
2904	spoolsv.exe
2636	spoolsv.exe
2616	spoolsv.exe
1816	spoolsv.exe
2956	spoolsv.exe
988	spoolsv.exe
2488	spoolsv.exe
344	spoolsv.exe
1580	spoolsv.exe
2656	spoolsv.exe
1928	spoolsv.exe
1568	spoolsv.exe
2228	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
900	explorer.exe
900	explorer.exe
1860	spoolsv.exe
900	explorer.exe
900	explorer.exe
1296	spoolsv.exe
900	explorer.exe
900	explorer.exe
2808	spoolsv.exe
900	explorer.exe
900	explorer.exe
2944	spoolsv.exe
900	explorer.exe
900	explorer.exe
2884	spoolsv.exe
900	explorer.exe
900	explorer.exe
2196	spoolsv.exe
900	explorer.exe
900	explorer.exe
1660	spoolsv.exe
900	explorer.exe
900	explorer.exe
1088	spoolsv.exe
900	explorer.exe
900	explorer.exe
2816	spoolsv.exe
900	explorer.exe
900	explorer.exe
1076	spoolsv.exe
900	explorer.exe
900	explorer.exe
2140	spoolsv.exe
900	explorer.exe
900	explorer.exe
3040	spoolsv.exe
900	explorer.exe
900	explorer.exe
700	spoolsv.exe
900	explorer.exe
900	explorer.exe
1328	spoolsv.exe
900	explorer.exe
900	explorer.exe
2724	spoolsv.exe
900	explorer.exe
900	explorer.exe
808	spoolsv.exe
900	explorer.exe
900	explorer.exe
2636	spoolsv.exe
900	explorer.exe
900	explorer.exe
1816	spoolsv.exe
900	explorer.exe
900	explorer.exe
988	spoolsv.exe
900	explorer.exe
900	explorer.exe
344	spoolsv.exe
900	explorer.exe
900	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 28 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2792 set thread context of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 set thread context of 3024	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	34
PID 2584 set thread context of 2324	2584	explorer.exe	38
PID 2324 set thread context of 900	2324	explorer.exe	39
PID 2324 set thread context of 832	2324	explorer.exe	40
PID 1860 set thread context of 2628	1860	spoolsv.exe	44
PID 1296 set thread context of 1592	1296	spoolsv.exe	48
PID 2808 set thread context of 2700	2808	spoolsv.exe	52
PID 2944 set thread context of 2756	2944	spoolsv.exe	56
PID 2884 set thread context of 2320	2884	spoolsv.exe	60
PID 2196 set thread context of 812	2196	spoolsv.exe	64
PID 1660 set thread context of 3028	1660	spoolsv.exe	68
PID 1088 set thread context of 2300	1088	spoolsv.exe	72
PID 2816 set thread context of 2548	2816	spoolsv.exe	76
PID 1076 set thread context of 1788	1076	spoolsv.exe	80
PID 2140 set thread context of 2356	2140	spoolsv.exe	84
PID 3040 set thread context of 2644	3040	spoolsv.exe	88
PID 700 set thread context of 2984	700	spoolsv.exe	92
PID 1328 set thread context of 1920	1328	spoolsv.exe	96
PID 2724 set thread context of 664	2724	spoolsv.exe	100
PID 808 set thread context of 2904	808	spoolsv.exe	104
PID 2636 set thread context of 2616	2636	spoolsv.exe	108
PID 1816 set thread context of 2956	1816	spoolsv.exe	112
PID 988 set thread context of 2488	988	spoolsv.exe	116
PID 344 set thread context of 1580	344	spoolsv.exe	120
PID 2656 set thread context of 1928	2656	spoolsv.exe	124
PID 1568 set thread context of 2228	1568	spoolsv.exe	128

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
2584	explorer.exe
1860	spoolsv.exe
900	explorer.exe
900	explorer.exe
1296	spoolsv.exe
900	explorer.exe
2808	spoolsv.exe
900	explorer.exe
2944	spoolsv.exe
900	explorer.exe
2884	spoolsv.exe
900	explorer.exe
2196	spoolsv.exe
900	explorer.exe
1660	spoolsv.exe
900	explorer.exe
1088	spoolsv.exe
900	explorer.exe
2816	spoolsv.exe
900	explorer.exe
1076	spoolsv.exe
900	explorer.exe
2140	spoolsv.exe
900	explorer.exe
3040	spoolsv.exe
900	explorer.exe
700	spoolsv.exe
900	explorer.exe
1328	spoolsv.exe
900	explorer.exe
2724	spoolsv.exe
900	explorer.exe
808	spoolsv.exe
900	explorer.exe
2636	spoolsv.exe
900	explorer.exe
1816	spoolsv.exe
900	explorer.exe
988	spoolsv.exe
900	explorer.exe
344	spoolsv.exe
900	explorer.exe
2656	spoolsv.exe
900	explorer.exe
1568	spoolsv.exe

Suspicious use of SetWindowsHookEx 54 IoCs

pid	Process
2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
2584	explorer.exe
2584	explorer.exe
900	explorer.exe
900	explorer.exe
1860	spoolsv.exe
1860	spoolsv.exe
900	explorer.exe
900	explorer.exe
1296	spoolsv.exe
1296	spoolsv.exe
2808	spoolsv.exe
2808	spoolsv.exe
2944	spoolsv.exe
2944	spoolsv.exe
2884	spoolsv.exe
2884	spoolsv.exe
2196	spoolsv.exe
2196	spoolsv.exe
1660	spoolsv.exe
1660	spoolsv.exe
1088	spoolsv.exe
1088	spoolsv.exe
2816	spoolsv.exe
2816	spoolsv.exe
1076	spoolsv.exe
1076	spoolsv.exe
2140	spoolsv.exe
2140	spoolsv.exe
3040	spoolsv.exe
3040	spoolsv.exe
700	spoolsv.exe
700	spoolsv.exe
1328	spoolsv.exe
1328	spoolsv.exe
2724	spoolsv.exe
2724	spoolsv.exe
808	spoolsv.exe
808	spoolsv.exe
2636	spoolsv.exe
2636	spoolsv.exe
1816	spoolsv.exe
1816	spoolsv.exe
988	spoolsv.exe
988	spoolsv.exe
344	spoolsv.exe
344	spoolsv.exe
2656	spoolsv.exe
2656	spoolsv.exe
1568	spoolsv.exe
1568	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2780	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	30
PID 2372 wrote to memory of 2780	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	30
PID 2372 wrote to memory of 2780	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	30
PID 2372 wrote to memory of 2780	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	30
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2372 wrote to memory of 2792	2372	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	32
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 2848	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	33
PID 2792 wrote to memory of 3024	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	34
PID 2792 wrote to memory of 3024	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	34
PID 2792 wrote to memory of 3024	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	34
PID 2792 wrote to memory of 3024	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	34
PID 2792 wrote to memory of 3024	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	34
PID 2792 wrote to memory of 3024	2792	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	34
PID 2848 wrote to memory of 2584	2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	35
PID 2848 wrote to memory of 2584	2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	35
PID 2848 wrote to memory of 2584	2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	35
PID 2848 wrote to memory of 2584	2848	830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe	35
PID 2584 wrote to memory of 1900	2584	explorer.exe	36
PID 2584 wrote to memory of 1900	2584	explorer.exe	36
PID 2584 wrote to memory of 1900	2584	explorer.exe	36
PID 2584 wrote to memory of 1900	2584	explorer.exe	36
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38
PID 2584 wrote to memory of 2324	2584	explorer.exe	38

C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
"C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
  C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
    C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1900
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2324
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2700
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2756
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:652
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:812
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2248
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2444
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2928
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1656
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:664
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:3004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2504
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:928
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1160
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:3012
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1460
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1648
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:832
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
114a26070e503bb2959c8cf89beccd10

SHA1
8b6c92b087d0e365db42f0b3db92b61f86e5b139

SHA256
830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7

SHA512
8d6bc52a2d0925fe2abb4f35f1602c01cd3782d8cdbdfada66164e5abb030ed6347fe0c222f2e3a07afb9510e1a61e76c72895e72aa766939a95e4d7283731d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
4eb382a65bcf2f51e611e69c08fc66f5

SHA1
3f5e44cf86ebb48246c29064df8def2dc77ab8ff

SHA256
1d42e578df936dac5a7fef9d666b5c706c0a838c6e9716aebac9023de2904757

SHA512
42689da5c54da288137b2c6d58fb8857d8be23d2b3b840fcf7d1753fceea6ef1367d845dad65f169e524f6398359559c2b533313fc9a503ac7aa86b1f0d01c95

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
273306165c52c828a64c159564e8fdc3

SHA1
98f1732773de3f41f09d958c5610bbfec1f34f59

SHA256
e9796d9c2aa680cd029081ebceb36bd036674eb16318a27296a66de13e2efe01

SHA512
2b01141c136c58eb918b359e87f80af4b4f1184d87875f793c4855ac568bb0312a1565ead8d757ba443d6d0edfcf9ce189bbb8e4f670b8f9da457b83ff5ff33d

Download Submit
memory/664-936-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/812-498-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/900-166-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1580-1173-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1592-292-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1788-701-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1920-888-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1928-1219-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2228-1266-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2300-600-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2320-446-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2324-174-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2324-145-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2356-746-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2488-1123-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2548-653-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2616-1030-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2628-242-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2644-793-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2700-341-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2756-396-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-41-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-47-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-13-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-79-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-8-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-9-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-43-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-48-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2792-49-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-18-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-42-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-21-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-24-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-40-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-6-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-27-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-29-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-35-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2792-45-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2792-12-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-15-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-46-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-19-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-31-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2792-25-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2848-69-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2848-54-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2848-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2848-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2848-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2848-139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2904-984-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2956-1078-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2984-840-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/3012-1314-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3024-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3024-83-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3024-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3024-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3028-549-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download