Analysis

  • max time kernel
    120s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2024 16:14

General

  • Target

    19d095859f52587b81b94f2d7d851997b7b6d9cc6234ec3b9eb325d0281cba6fN.exe

  • Size

    1.2MB

  • MD5

    9660ab44b29aad1d871d75f47f0d44e0

  • SHA1

    32fd669a0b30b5c2511c2bc9940322b6aeea11c9

  • SHA256

    19d095859f52587b81b94f2d7d851997b7b6d9cc6234ec3b9eb325d0281cba6f

  • SHA512

    1591cb8ee52e87effde162b2dfd1b0446e12c2536ca9e1ad0c590fbc18a1c5d8b0e0ddb4ac9925c3acd4b920b1eb06c95dfe74fc146e0627461d2798d582f6fc

  • SSDEEP

    12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ko:OIbGD2JTu0GoZQDbGV6eH81ko

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19d095859f52587b81b94f2d7d851997b7b6d9cc6234ec3b9eb325d0281cba6fN.exe
    "C:\Users\Admin\AppData\Local\Temp\19d095859f52587b81b94f2d7d851997b7b6d9cc6234ec3b9eb325d0281cba6fN.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\19d095859f52587b81b94f2d7d851997b7b6d9cc6234ec3b9eb325d0281cba6fN.exe
      "C:\Users\Admin\AppData\Local\Temp\19d095859f52587b81b94f2d7d851997b7b6d9cc6234ec3b9eb325d0281cba6fN.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4392
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2052
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4456
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4852
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:624
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:532
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2172
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2860
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2476
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:228
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1632
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1576
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3660
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1648
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4608
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3176
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4196
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3084
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1372
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3612
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2704
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2024
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3116
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2160
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2368
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:552
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4832
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:452
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4240
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4540
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1484
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3896
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3568
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2100
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4436
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4064
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4212
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:528
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:320
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3992
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3968
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2792
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3268
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4348
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:824
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4620
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1408
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:840
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1584
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3056
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4796
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3480
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4476
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1592
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:908
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4848
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:536
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4104
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:224
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1704
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4560
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4768
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4364
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2608
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4084
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
              PID:5024
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
                PID:4928
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                  PID:4676
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                    PID:3860
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3824
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                      PID:2028
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                        PID:1512
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                          PID:4896
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:1252
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:4720
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                              PID:4128
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                                PID:3664
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                  PID:3184
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                    PID:4816
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                      PID:2872
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4684
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:2748
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:4612
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:1468
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:5004
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:3316
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:1636
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:3836
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:2768
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:1656
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                          PID:860
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3460
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:4008
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:3988
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1132
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:4996
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1364
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:4112
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                    PID:4444
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4164
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1892
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1728
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4800
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                      PID:32
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:3032
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:1748
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4512
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3068
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:1528
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:4332
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:4056
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:4188
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:5132
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5156
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:5180
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:5204
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:5228
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5252
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:5284
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:5308
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:5332
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5356
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:5380
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:5404
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5428
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5452
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:5480
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5504
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                        PID:5532
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                          PID:5556
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:5580
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                              PID:5604
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                                PID:5628
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                  PID:5652
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                  5⤵
                                                                                                                    PID:5692
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    5⤵
                                                                                                                      PID:5716
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5740
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5768
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                        PID:5792
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                          PID:5816
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                          5⤵
                                                                                                                            PID:5840
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                              PID:5864
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                                PID:5916
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                  PID:5940
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5964
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5988
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                    PID:6012
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:6040
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                      PID:6064
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:6088
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                        PID:6136
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5172
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                          PID:3376
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                            PID:5304
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                              PID:5376
                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                              5⤵
                                                                                                                                                PID:5444
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                5⤵
                                                                                                                                                  PID:5500
                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                  5⤵
                                                                                                                                                    PID:5576
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5708
                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                      5⤵
                                                                                                                                                        PID:5760
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        5⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5836
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        5⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5892
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        5⤵
                                                                                                                                                          PID:5932
                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                          5⤵
                                                                                                                                                            PID:5984
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            5⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:6060
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            5⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:6120
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            5⤵
                                                                                                                                                              PID:5420
                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                              5⤵
                                                                                                                                                                PID:5624
                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5676
                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:5832
                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:5980
                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5276
                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:6020
                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5152
                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5812
                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:5684
                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:6164
                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:6200
                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:6232
                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:6256
                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:6284
                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:6308
                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:6336
                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:6364
                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:6388
                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:6412
                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:6436
                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:6460
                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:6488
                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:6512
                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:6540
                                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:6568
                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:6592
                                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:6616
                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:6640
                                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:6664
                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:6692
                                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:6716
                                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:6740
                                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:6764
                                                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:6792
                                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:6816
                                                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:6840
                                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:6864
                                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:6904
                                                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:6928
                                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:6952
                                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:6976
                                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:7000
                                                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:7024
                                                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:7052
                                                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:7076
                                                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:7124
                                                                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:7148
                                                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:6160
                                                                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:6252
                                                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:6280
                                                                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:6384
                                                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:6504
                                                                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:6588
                                                                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:6712
                                                                                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:6780
                                                                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:2324
                                                                                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:6896
                                                                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6948
                                                                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:7016
                                                                                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:7108
                                                                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:6156
                                                                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:6380
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\diskperf.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\diskperf.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1396

                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          9660ab44b29aad1d871d75f47f0d44e0

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          32fd669a0b30b5c2511c2bc9940322b6aeea11c9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          19d095859f52587b81b94f2d7d851997b7b6d9cc6234ec3b9eb325d0281cba6f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          1591cb8ee52e87effde162b2dfd1b0446e12c2536ca9e1ad0c590fbc18a1c5d8b0e0ddb4ac9925c3acd4b920b1eb06c95dfe74fc146e0627461d2798d582f6fc

                                                                                                                                                                                                                                                        • C:\Windows\System\explorer.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          c2e43b45de10dc234ac6ba30d95f96fa

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e25ef9d909b324d58337d534fc580225706fc3e2

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          d0e714b92b076542e0bc383166e6a7995ba940b39f25b72e62c32b07bc336580

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          84f9f64d068f89b2d0228e41a2c6d03af97d07d587f0e7c69d3a3a6aa05709afb80ba4b52398aae5f29195000597fe885c9f726736c5c871466a2d115654b5ae

                                                                                                                                                                                                                                                        • C:\Windows\System\spoolsv.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          36c4db113a925084ad774c410536e2c5

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          8d3199fad51caaa1ad40fd380bdc4180dde0df2c

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          1df168bbec8c034ec108a2de74e473c083ab0802c6e9782662eaad098429558f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          61d21cc118a0f3d0f3147005b7fb3a6903bc9bde771ed774356f5132d102abd0540bea933b5558a5a8632e25b1d19e7405147a8ad330c816134b8018772addb0

                                                                                                                                                                                                                                                        • memory/224-260-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/228-379-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/228-78-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/320-186-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/532-66-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/532-360-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/532-65-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/536-254-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/552-650-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/552-140-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/624-355-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/624-63-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/624-62-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/824-208-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/860-388-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1252-317-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1372-114-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1372-513-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1468-354-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1484-158-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1512-311-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1576-86-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1576-88-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1576-87-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1576-389-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1584-222-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1592-242-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1632-386-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1636-368-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1648-417-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1648-94-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1656-382-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/1704-267-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2024-125-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2024-580-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2052-26-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2052-25-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2052-27-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2052-51-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2052-29-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2160-616-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2172-365-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2172-69-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2172-68-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2368-136-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2368-633-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2476-374-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2608-282-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2704-121-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2704-557-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2748-345-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2768-378-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2792-197-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2860-71-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/2860-370-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3084-490-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3084-112-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3084-111-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3084-110-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3116-129-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3116-601-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3176-453-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3176-102-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3184-331-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3268-201-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3316-363-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3460-392-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3568-165-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3612-535-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3660-394-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3660-92-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3660-91-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3660-90-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3664-328-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3824-304-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3836-373-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3860-300-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3992-190-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3996-4-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3996-1-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3996-16-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3996-5-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                        • memory/3996-0-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/3996-3-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                        • memory/3996-2-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4008-397-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4064-175-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4084-286-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4128-324-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4196-106-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4196-107-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4196-470-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4196-108-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4212-179-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4392-13-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          248KB

                                                                                                                                                                                                                                                        • memory/4392-9-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          248KB

                                                                                                                                                                                                                                                        • memory/4392-28-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          248KB

                                                                                                                                                                                                                                                        • memory/4456-85-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          248KB

                                                                                                                                                                                                                                                        • memory/4456-41-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          248KB

                                                                                                                                                                                                                                                        • memory/4476-238-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4540-154-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4560-272-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4608-434-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4608-100-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4608-98-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4608-99-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4612-349-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4620-212-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4676-297-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4684-341-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4688-45-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                        • memory/4688-48-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                        • memory/4688-44-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                        • memory/4720-320-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4768-276-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4796-229-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4816-335-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4832-144-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4832-668-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4848-249-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4852-57-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4852-350-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/4852-58-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/5004-358-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                        • memory/5024-290-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.1MB