warzonerat | 22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edc

Analysis

max time kernel
87s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
Size

8.2MB
MD5

5b38b3b2a571a945db7ef36cedf360a0
SHA1

d8c31282b5842d0a4c8c4842c70690e52a79b700
SHA256

22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edc
SHA512

7f053766692102ab9aa74e5daa2253649b4abdf407702bb9685f4c0d4dfb324d90a4d687578d4e264be502c894e3f91a80a2e7087dda453ff1a29166bdebf57f
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecH:V8e8e8f8e8e8Y

Score

10^/10

warzonerat aspackv2 discovery infostealer persistence rat

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	4880	WerFault.exe	87

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 40 IoCs

rat

resource	yara_rule
behavioral2/files/0x000c000000023b82-27.dat	warzonerat
behavioral2/files/0x0032000000023b80-49.dat	warzonerat
behavioral2/files/0x0009000000022700-60.dat	warzonerat
behavioral2/files/0x0009000000022700-74.dat	warzonerat
behavioral2/files/0x0009000000022700-75.dat	warzonerat
behavioral2/files/0x0009000000022700-84.dat	warzonerat
behavioral2/files/0x0009000000022700-87.dat	warzonerat
behavioral2/files/0x0009000000022700-89.dat	warzonerat
behavioral2/files/0x0009000000022700-90.dat	warzonerat
behavioral2/files/0x0009000000022700-92.dat	warzonerat
behavioral2/files/0x0009000000022700-94.dat	warzonerat
behavioral2/files/0x0009000000022700-95.dat	warzonerat
behavioral2/files/0x0009000000022700-97.dat	warzonerat
behavioral2/files/0x0009000000022700-98.dat	warzonerat
behavioral2/files/0x0009000000022700-99.dat	warzonerat
behavioral2/files/0x0009000000022700-100.dat	warzonerat
behavioral2/files/0x0009000000022700-101.dat	warzonerat
behavioral2/files/0x0009000000022700-104.dat	warzonerat
behavioral2/files/0x0009000000022700-107.dat	warzonerat
behavioral2/files/0x0009000000022700-108.dat	warzonerat
behavioral2/files/0x0009000000022700-109.dat	warzonerat
behavioral2/files/0x0009000000022700-110.dat	warzonerat
behavioral2/files/0x0009000000022700-111.dat	warzonerat
behavioral2/files/0x0009000000022700-113.dat	warzonerat
behavioral2/files/0x0009000000022700-114.dat	warzonerat
behavioral2/files/0x0009000000022700-115.dat	warzonerat
behavioral2/files/0x0009000000022700-116.dat	warzonerat
behavioral2/files/0x0009000000022700-117.dat	warzonerat
behavioral2/files/0x0009000000022700-119.dat	warzonerat
behavioral2/files/0x0009000000022700-120.dat	warzonerat
behavioral2/files/0x0009000000022700-122.dat	warzonerat
behavioral2/files/0x0009000000022700-124.dat	warzonerat
behavioral2/files/0x0009000000022700-125.dat	warzonerat
behavioral2/files/0x0009000000022700-126.dat	warzonerat
behavioral2/files/0x0009000000022700-127.dat	warzonerat
behavioral2/files/0x0009000000022700-128.dat	warzonerat
behavioral2/files/0x0009000000022700-130.dat	warzonerat
behavioral2/files/0x0009000000022700-131.dat	warzonerat
behavioral2/files/0x0009000000022700-132.dat	warzonerat
behavioral2/files/0x0009000000022700-133.dat	warzonerat

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c000000023b82-27.dat	aspack_v212_v242
behavioral2/files/0x0032000000023b80-49.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-60.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-74.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-75.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-84.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-87.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-89.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-90.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-92.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-94.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-95.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-97.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-98.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-99.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-100.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-101.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-104.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-107.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-108.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-109.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-110.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-111.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-113.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-114.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-115.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-116.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-117.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-119.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-120.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-122.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-124.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-125.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-126.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-127.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-128.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-130.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-131.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-132.dat	aspack_v212_v242
behavioral2/files/0x0009000000022700-133.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1296	explorer.exe
2264	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 set thread context of 5112	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	94
PID 1296 set thread context of 2264	1296	explorer.exe	96

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2100	2716	WerFault.exe	99
228	4548	WerFault.exe
1228	4960	WerFault.exe	81
1264	1572	WerFault.exe
4044	3708	WerFault.exe
3944	3472	WerFault.exe
2560	3496	WerFault.exe
3112	972	WerFault.exe
212	2404	WerFault.exe
876	888	WerFault.exe
3064	4944	WerFault.exe
1776	3808	WerFault.exe
372	1580	WerFault.exe	77
4992	1888	WerFault.exe
2708	4908	WerFault.exe	142
1996	2736	WerFault.exe
4476	5048	WerFault.exe
3152	3656	WerFault.exe	151
1224	2964	WerFault.exe
4700	4160	WerFault.exe
3964	3956	WerFault.exe
4888	2432	WerFault.exe	163
4284	2848	WerFault.exe
1120	3924	WerFault.exe
5052	3580	WerFault.exe
1812	4664	WerFault.exe
2112	4244	WerFault.exe	178
3528	3020	WerFault.exe
1128	4524	WerFault.exe
1932	2928	WerFault.exe
1572	928	WerFault.exe
4184	2260	WerFault.exe
948	3024	WerFault.exe
556	2300	WerFault.exe
1100	3188	WerFault.exe
212	1480	WerFault.exe	205
888	2776	WerFault.exe
4944	1628	WerFault.exe	211
3808	4552	WerFault.exe
5020	1988	WerFault.exe	217
4992	2760	WerFault.exe
2708	2448	WerFault.exe
4036	3712	WerFault.exe
2728	4536	WerFault.exe
1272	4788	WerFault.exe
4572	1532	WerFault.exe
552	3140	WerFault.exe	238
5100	4432	WerFault.exe
2196	2856	WerFault.exe
4936	3492	WerFault.exe	247
1352	5104	WerFault.exe
2744	840	WerFault.exe
4684	4976	WerFault.exe
3260	5040	WerFault.exe
4560	3372	WerFault.exe
1280	1980	WerFault.exe
1884	4880	WerFault.exe	87
4648	2928	WerFault.exe	271
3948	1572	WerFault.exe	192
4844	4288	WerFault.exe
4564	948	WerFault.exe	280
2616	3436	WerFault.exe
2268	4860	WerFault.exe
3220	4360	WerFault.exe	289

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
944	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
944	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
944	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
944	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
2264	explorer.exe
2264	explorer.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 944	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	93
PID 1200 wrote to memory of 5112	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	94
PID 1200 wrote to memory of 5112	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	94
PID 1200 wrote to memory of 5112	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	94
PID 1200 wrote to memory of 5112	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	94
PID 1200 wrote to memory of 5112	1200	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	94
PID 944 wrote to memory of 1296	944	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	95
PID 944 wrote to memory of 1296	944	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	95
PID 944 wrote to memory of 1296	944	22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe	95
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 2264	1296	explorer.exe	96
PID 1296 wrote to memory of 1912	1296	explorer.exe	97
PID 1296 wrote to memory of 1912	1296	explorer.exe	97
PID 1296 wrote to memory of 1912	1296	explorer.exe	97

C:\Users\Admin\AppData\Local\Temp\22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
"C:\Users\Admin\AppData\Local\Temp\22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe
  "C:\Users\Admin\AppData\Local\Temp\22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edcN.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:944
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2716
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 192
        6⤵
        Program crash
        
        PID:2100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 192
        6⤵
        Program crash
        
        PID:228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 192
        6⤵
        Program crash
        
        PID:1228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 192
        6⤵
        Program crash
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 200
        6⤵
        Program crash
        
        PID:4044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 200
        6⤵
        Program crash
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 192
        6⤵
        Program crash
        
        PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 192
        6⤵
        Program crash
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 192
        6⤵
        Program crash
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 192
        6⤵
        Program crash
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 200
        6⤵
        Program crash
        
        PID:3064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 192
        6⤵
        Program crash
        
        PID:1776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 192
        6⤵
        Program crash
        
        PID:372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 192
        6⤵
        Program crash
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 192
        6⤵
        Program crash
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 192
        6⤵
        Program crash
        
        PID:1996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5048
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 192
        6⤵
        Program crash
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3656
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 192
        6⤵
        Program crash
        
        PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 200
        6⤵
        Program crash
        
        PID:1224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 192
        6⤵
        Program crash
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 200
        6⤵
        Program crash
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 192
        6⤵
        Program crash
        
        PID:4888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 192
        6⤵
        Program crash
        
        PID:4284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 192
        6⤵
        Program crash
        
        PID:1120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 192
        6⤵
        Program crash
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 200
        6⤵
        Program crash
        
        PID:1812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 192
        6⤵
        Program crash
        
        PID:2112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 200
        6⤵
        Program crash
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 192
        6⤵
        Program crash
        
        PID:1128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 192
        6⤵
        Program crash
        
        PID:1932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 192
        6⤵
        Program crash
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 192
        6⤵
        Program crash
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 192
        6⤵
        Program crash
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 192
        6⤵
        Program crash
        
        PID:556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 192
        6⤵
        Program crash
        
        PID:1100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 192
        6⤵
        Program crash
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 200
        6⤵
        Program crash
        
        PID:888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 192
        6⤵
        Program crash
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 192
        6⤵
        Program crash
        
        PID:3808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1988
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 192
        6⤵
        Program crash
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 192
        6⤵
        Program crash
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2448
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 192
        6⤵
        Program crash
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 192
        6⤵
        Program crash
        
        PID:4036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 192
        6⤵
        Program crash
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 192
        6⤵
        Program crash
        
        PID:1272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 192
        6⤵
        Program crash
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 200
        6⤵
        Program crash
        
        PID:552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 192
        6⤵
        Program crash
        
        PID:5100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 192
        6⤵
        Program crash
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 192
        6⤵
        Program crash
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 200
        6⤵
        Program crash
        
        PID:1352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 192
        6⤵
        Program crash
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 192
        6⤵
        Program crash
        
        PID:4684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 200
        6⤵
        Program crash
        
        PID:3260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3372
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 192
        6⤵
        Program crash
        
        PID:4560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 192
        6⤵
        Program crash
        
        PID:1280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 192
        6⤵
        Process spawned unexpected child process
        Program crash
        
        PID:1884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 192
        6⤵
        Program crash
        
        PID:4648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 192
        6⤵
        Program crash
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 192
        6⤵
        Program crash
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 192
        6⤵
        Program crash
        
        PID:4564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 192
        6⤵
        Program crash
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 200
        6⤵
        Program crash
        
        PID:2268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 192
        6⤵
        Program crash
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 200
        6⤵
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 192
        6⤵
        
        PID:4848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2240
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 200
        6⤵
        
        PID:2604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 192
        6⤵
        
        PID:812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 192
        6⤵
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 192
        6⤵
        
        PID:4540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 192
        6⤵
        
        PID:2736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 192
        6⤵
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 192
        6⤵
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 192
        6⤵
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 200
        6⤵
        
        PID:2880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 192
        6⤵
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 192
        6⤵
        
        PID:3292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4152
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 192
        6⤵
        
        PID:4284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 192
        6⤵
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 192
        6⤵
        
        PID:5104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 192
        6⤵
        
        PID:840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 200
        6⤵
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 200
        6⤵
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 192
        6⤵
        
        PID:1128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 192
        6⤵
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 192
        6⤵
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 192
        6⤵
        
        PID:1704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 192
        6⤵
        
        PID:2920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 200
        6⤵
        
        PID:1528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 192
        6⤵
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 200
        6⤵
        
        PID:512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 192
        6⤵
        
        PID:3572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1656
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 192
        6⤵
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 192
        6⤵
        
        PID:888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 192
        6⤵
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 192
        6⤵
        
        PID:2240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 200
        6⤵
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 200
        6⤵
        
        PID:4908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 192
        6⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 192
        6⤵
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 192
        6⤵
        
        PID:3524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 192
        6⤵
        
        PID:688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4268
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 192
        6⤵
        
        PID:1076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 192
        6⤵
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 192
        6⤵
        
        PID:2876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 200
        6⤵
        
        PID:3116
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:1912
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2716 -ip 2716
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4548 -ip 4548
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4960 -ip 4960
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1572 -ip 1572
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3708 -ip 3708
1⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3472 -ip 3472
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3496 -ip 3496
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 972 -ip 972
1⤵
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2404 -ip 2404
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 888 -ip 888
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4944 -ip 4944
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3808 -ip 3808
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1580 -ip 1580
1⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1888 -ip 1888
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4908 -ip 4908
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2736 -ip 2736
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5048 -ip 5048
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3656 -ip 3656
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2964 -ip 2964
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4160 -ip 4160
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3956 -ip 3956
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2432 -ip 2432
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2848 -ip 2848
1⤵
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3924 -ip 3924
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3580 -ip 3580
1⤵
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4664 -ip 4664
1⤵
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4244 -ip 4244
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3020 -ip 3020
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4524 -ip 4524
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2928 -ip 2928
1⤵
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 928 -ip 928
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2260 -ip 2260
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3024 -ip 3024
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2300 -ip 2300
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3188 -ip 3188
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1480 -ip 1480
1⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2776 -ip 2776
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1628 -ip 1628
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4552 -ip 4552
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1988 -ip 1988
1⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2760 -ip 2760
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2448 -ip 2448
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3712 -ip 3712
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4536 -ip 4536
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4788 -ip 4788
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1532 -ip 1532
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3140 -ip 3140
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4432 -ip 4432
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2856 -ip 2856
1⤵
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3492 -ip 3492
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5104 -ip 5104
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 840 -ip 840
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4976 -ip 4976
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5040 -ip 5040
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3372 -ip 3372
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1980 -ip 1980
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4880 -ip 4880
1⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2928 -ip 2928
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1572 -ip 1572
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4288 -ip 4288
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 948 -ip 948
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3436 -ip 3436
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4860 -ip 4860
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4360 -ip 4360
1⤵
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 888 -ip 888
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4692 -ip 4692
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2240 -ip 2240
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4884 -ip 4884
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4916 -ip 4916
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1424 -ip 1424
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2352 -ip 2352
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2460 -ip 2460
1⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3660 -ip 3660
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4584 -ip 4584
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4160 -ip 4160
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3868 -ip 3868
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2748 -ip 2748
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4152 -ip 4152
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2668 -ip 2668
1⤵
PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2456 -ip 2456
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3484 -ip 3484
1⤵
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3312 -ip 3312
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5064 -ip 5064
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4548 -ip 4548
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3720 -ip 3720
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4112 -ip 4112
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1264 -ip 1264
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3708 -ip 3708
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 232 -ip 232
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2140 -ip 2140
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4496 -ip 4496
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3920 -ip 3920
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1656 -ip 1656
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4628 -ip 4628
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1984 -ip 1984
1⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3680 -ip 3680
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1200 -ip 1200
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1428 -ip 1428
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3532 -ip 3532
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4476 -ip 4476
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4536 -ip 4536
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1272 -ip 1272
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4268 -ip 4268
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3140 -ip 3140
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3164 -ip 3164
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1092 -ip 1092
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
5b38b3b2a571a945db7ef36cedf360a0

SHA1
d8c31282b5842d0a4c8c4842c70690e52a79b700

SHA256
22d2fcaf768cad0239276f9f52b2709b434282c393aa864509767b50b1857edc

SHA512
7f053766692102ab9aa74e5daa2253649b4abdf407702bb9685f4c0d4dfb324d90a4d687578d4e264be502c894e3f91a80a2e7087dda453ff1a29166bdebf57f

Download Submit
C:\Windows\System\explorer.exe

Filesize
8.2MB

MD5
24b76e74a57046938e93b316b37d82ff

SHA1
9f7f92520ac10c3af4e2802e4ed5a067a7077bb7

SHA256
f0b3b5f76fc2794d1ad4360bae006b45f2b8fb780b4bf3631fe504d9000a1403

SHA512
a984171d382e5dbdef74d12ba8a85104a9b06bda9426c9595b717c303a90c173962e68fe9980db14372951e54bd5cb1e84f5985716a96490f71fadf7449850e1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.9MB

MD5
6e3cd4792eade9c6881cddbc9915e7e7

SHA1
4b887b5fb3f03ccb0032d30932e5ad88942b8eda

SHA256
55bbeb929e5b1e799fa6bf6bab0b15e208a1cd9420ac9b44fe3930c21f191221

SHA512
7e117227e0c1aa1232c7a540eb71102ea2318e150ff5102d4aa2adb0db537d55f5a18f3eaa744d0497b1078cad4468e36efdf45d7c70f59109ca3907f8e063ac

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
7.4MB

MD5
6dc68d5f865e1fd4ecae6184ccf7b65d

SHA1
ef74f62eac51353927c90668b9d9c5cbbe232fa7

SHA256
5f8dda4cfd3d4e33d8075dd8695d8c88393c63d58d1272303a6b77daddde0f47

SHA512
7b5a67049c0f42118cf8584ac5662360f158734fc33651db571dbe0404c97371d28e01d341fd5ddb241763e67820dda56f31a19ce5d19919875e03e3703a8de3

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
7.6MB

MD5
f63c43bc3ac38d57ae2de569c60bff02

SHA1
248866b7a94b2e3f529fd06c13b909474c67e67a

SHA256
0b9404460f4419fcd69fa17dc3d0a67ae0ae6469556f82176ad9e93ac9c71100

SHA512
c805023cff1382eccad5cd42db1545a390f985d2ef987ad55368c8d1359829df12bc12fc1e26b82a96dcb7f8d6de78156532de642bfa58a89adff33455615b78

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.0MB

MD5
2379a121cc0341f080523154737d2daf

SHA1
4434c2c3d58b4b18d8e23b699538a51df1e5c483

SHA256
b44bc1512b37658baba76cefcce2b77725d5d37437cc80df325260c2d465651b

SHA512
5971c2c050aa0fa159ae0794ab2fcd18294d238bbb1c9d0250b32eac2a785441c35ed603a6c31b44382374575122842fc36b8c5999121c225a896e351aa38d8f

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.8MB

MD5
9b9983645bec0a9599dc7ab07eca707e

SHA1
51a992ee5e96c18b3ffdb9cbea51cf431f4d9713

SHA256
c56afb3539528284fb97a43edf9cccb1f2e905b496e4b5d4e52d8bf4e2f14af0

SHA512
36384c552f515ada5257c17a5c897b72a3a0d75c04dd42e79e125bc0a698cd22b58da1b855843373d507c82be40d5d824b8551e0a80188cbd4c6829bcc58d8f9

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
5.4MB

MD5
39a188d7a7820c6487c1dc2b82e0dd32

SHA1
2a473812e4e4f73216d4349372388bb8aa28cb46

SHA256
0a308a945a88dc6b4a04573be60d1ac27443d9cacd3065d87231c10e8e0b3f01

SHA512
73982b76726b37936002c2aa0870677bc1b4ee740ad681e6e577bac99ca2ab9c2c170b4669f6603e7d365efb132518b7dc23a86621d482cce1a5651a7e3c79d0

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
5.6MB

MD5
9f53625799a8354db78ef50079fd19dc

SHA1
239069c1437f8a2eb60999253a002fe6cf332b6f

SHA256
5d5cde03152dad9119d1e53b53afb2a929065c42be4d005f2c9a2db75a15b5bc

SHA512
0f62d1019ec8043e8297dc4bd2b93ad036652972d720b8cd9178416c333c860c4a76d39ddd289734f2bbb37f2d3368b34777c2660e91dedea643cc4218e8877b

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
5.1MB

MD5
0498a9b633e544cbae86f4bf2ec9f247

SHA1
6d40ed26a3635aad3c26dbc83ac16d7398fbdd99

SHA256
c40373d9542085530a17114adcb9383c9cc10825a8397bdfbd1df5c6fbefa644

SHA512
0543f5b63fadc034f1f7292fcc35a1bb59eab4fd00ec4e7d36a99f1a5ad07bc0f862366dbe4cee91070fc4cc2adfb997421f964db915b02822fb72399b4be8b2

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.1MB

MD5
08333f5e16c3108baf7ae84d129ce1b9

SHA1
70f0782748ef40838469afe0f4d0447b9d738df3

SHA256
08132e2eebaa237ef62b06eaf1740c241e1c2e113bfeb13ee2a5fe3668929453

SHA512
95a0726c3a547a83c4dc4aed10ddf8aceef90812f0b0276ec29343533db1ef639aecc9c92e5918fe62d99a4b8c9e7fcb8826dbbba5d31ed16e149f9e54b910d5

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
5.1MB

MD5
873e33aacd8a369a38429ad298e7bace

SHA1
fa5b970c95bab4ab48da495b892cc4e764d472f7

SHA256
a1d0642db5e3418b7c13d222261f2e80a9d991bdb8ae606642afa5fbf178a5d2

SHA512
8e28c6089a5b69fd44d8bb7ed182e9840ee55de2704a642554ab908143ca07c71004042628c7be7f4f9aa6fecab4112f52fd0c7c4fa7697a7c96d742f0bcb768

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.6MB

MD5
4c846af8f84cb6d2cf650c1b48e8f9de

SHA1
482ac7e0c6a5025640dc39c4c445e2d7188a970c

SHA256
2b4866dc2d65471ccdf620ad3fec0b60772755ceb28c95d2329024c5c6ce6012

SHA512
bd0a7cdc9cb83ca0cfed9d6888b7890a856be578d45f220f3404057227d86476868981534607fefe44328f5331e994381e6366bbfafa5398c58645e9550426e0

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
5.8MB

MD5
7980cfbb8b1855c517755abf8210d66d

SHA1
a7c7b06d4b8eadb30b6a721868b497af7d859c0c

SHA256
7720d0944050fcdf03caf7d3afa820448a5d111adf2cc01fcb0338cae3bfa582

SHA512
1fe60aba086769028db9b8b61292545d1e67b5afafc43cf5d4cc706ce6c96217d99daf673a736757272e2bbc4bf2f26f7b5e3396d5d8622978da7f3e42389ecd

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.9MB

MD5
549fa7f2a04a966727d19e3fcdd4da05

SHA1
2bb859f4ee81a07e71d35c6c0b7ba53e67e10a21

SHA256
9807b923b5e74f4cfeb20d5aebc15c3003f158b376b50147280644332f586489

SHA512
a9487464e4b3c271cdd7845902a28833fcf17b537a2d4d2caf540122785bf6429b5e3b5ae0083b817f53a6bb6a5ac819eed6cda7e4467b9cc58fe85946840914

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
5.1MB

MD5
f5ca97d246bcda258d4460b94e9bd559

SHA1
ace92b0b7703125e598aa9cd9bb1a719da5ec343

SHA256
7afda2dfc8d230f3d4c4405f3f50c464dc0b7377a832e1fe01a76b8979ff5da8

SHA512
9e2423a5dc414ce0c4d7112011440b1f19afed656b973ad8deb9bf123f7739ff0bce0a4c16c955c2eaf32df790e1f8c615f66a4d450c506703229433a0595650

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.3MB

MD5
bdee5d95e8fe3cd8f76e600de0182a15

SHA1
34d32fdafb0ac91933ca4a88a6e8c882c4ab1d43

SHA256
2056903509fa6a515bfcfc84e7a14be8936a90de9cf0008cd718dd9113d9e339

SHA512
5ee81c5649165ca60eba44811a25ff82524485acbdef605b6ccb350afa9ade0d4c890f0e5bf47f806c8a032ae0191410ee21ba5b9142b439d467a2526053aec9

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.9MB

MD5
bcf6f9613139a7f42d4a71310dec79a0

SHA1
cd7524c8e554c51aa51cc5e0ef28df4de8e8c034

SHA256
54c3e7abc3a6d31461940b6afb62036fbd3e5454f45099288967100db31e653b

SHA512
4d393f732a9c4ff205488e2a84fe14d843b084290fcff4db1e0aef33a0065507a53ffdabbf7236061687f6db985da276eb67fecb99285b4f721f1e5f7627bd15

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.1MB

MD5
28323c556599c3db9f0103d2d6fce62c

SHA1
40ef7efc7842e1a8fdd3cb64770a5894e5878ae2

SHA256
c16d7f4a5c9d10363f64e57d074bd1f3ca4839a2dc818eaf925f6f2b77fd697e

SHA512
4760054825c68bc536f917a396ae1e4babc565f5085243095dc1ca6149271447314dd828aec5335e8c06a4a7755ce79d9aee2e80ac08e11f57a14c641dd16e0a

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.1MB

MD5
41ac5579a47bc6a29f0c9d3da6d7911b

SHA1
8fe93693326916c7d347ee996f73b0ed3d3b6f30

SHA256
c470627aba2039f056362e69b502a8f824b06f52313fb16f28f9c257e8dc34ba

SHA512
7371f6c8fab909b4e1cecaf6a07bae3898b958eecc1d9fe0d3970941b8da21925344bdd18378fa62131cb7d42aca7007179057c6f4e2bf1735a178d034b133b8

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.4MB

MD5
43636ec9a5b02942df4ff04429b73a06

SHA1
1acf4771a710a9f5a1509ad6a99d14aa4ceda2ed

SHA256
bd2d97e4ba6cd6ac9a672337799a61a485fe94445be3b2556533c3381753703a

SHA512
fea9f4e14b87b95a1d7fc3e0f8f2cac3e4c0ad76cf3eb5c8ce2d4a1f850d99387cabc748dc24f3701a720570d499126aa83b9f5d4b5fba868f85880f5392b5d2

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
4.4MB

MD5
dd95434af2d0eb38b2d8925af73aa2f7

SHA1
5da1b7a1333605698ec410cb2f2031668ffae45a

SHA256
5dd7d09634dccbebe5e0903c50623020e4a25063e346d8d89cc3b97ac0e9edbf

SHA512
85b27df2d80c326916c03d22fde7aadbbbd21c8ac7439003d6a49e8d38feadebe102c36b0e4dc7e8891480080fbd1dc0157304f79540249b6779fedf9434cc85

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
3.9MB

MD5
01cf48a25643cee7497d7609d45addf1

SHA1
df4c03a689cfa6ec299d5bb86763dc6f25905cce

SHA256
030d195bcea6347ce12758f11640d9193ef18083f34801ff792c2c47f731fc62

SHA512
d0408110d3098c7857adbeabd6bd1e549c74467346d8ae1f5aa1eef65bed7d6565aa5e607f925209d01e8f463e548afb9a978578ac15b690503f678211632238

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
3.9MB

MD5
a960cdbb26a669efefb4ba6df8b1bccb

SHA1
c8d1dc2b948657510865c34a630effcb4bb7cd0d

SHA256
21cd113d4cd4519e063fd81e2ac28645113eb992de8db05ca6da78064818836f

SHA512
6f55fbf8100f4870c88807718aa01e6573255a7e27ad8a11bfdf389a5d4d57c4b06678d33adb3318aeda20ec35d54deeda4283835751618f7faf4223963ca124

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
3.6MB

MD5
1be41ad2558332eb913310c1ca116460

SHA1
52c48dff4b7d38664b1d34f85464ac7496835e05

SHA256
0ff3cb74a7338faade888f1011a040f2d620a0dd5e913eb803d3aa8621edb218

SHA512
6182fb292cd48144c889e527d9c3fc5e7818f4f477c9f894bc19f88d0becc341d801276d91fbd46df0a429bfc63331b674c1845642c5e0a1c843a22c364409e1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
3.9MB

MD5
1b6174cc2f6791f7a71bec3740d86bf7

SHA1
75c766a3a566a35af9ab7a75ac6aaff6df81a25a

SHA256
3bde7bcf0c20dbebf21c85c9a4faa3cf68f8c366980ccc7f0b79c0a39d23ae23

SHA512
575a3b0dfdbc5b7e3ee4405e2af2f5f8e5970d7bc6a7f8f019e70824516c2e7f26133b2ebee5243f02ed8f88607e3e222639a47f6446f9cec459398c75e3c6cc

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
3.4MB

MD5
7105cd75e9c68b9ecdc6a3b9cc23f78d

SHA1
b7a92738ac425fd59fecebaa24c2095d38674867

SHA256
b5f5b0832c163e26991d52cbc747aa5e300753ce801513b8f416ef94e09549df

SHA512
cdb2075a716edae1e68198e2e40f98af48cb2c39b0cb2c16248ae95c89cffed6de3fe17f3cbd2e97c6209d27ce09265cefb2a43f7f0826758d4dfa64353c7286

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
8.2MB

MD5
3f22a223fb3946e4475e5aa49a0c43e5

SHA1
0e1925272ec1c64b83ee9a86ab2ac82ec30f8179

SHA256
3312d1b01a6ae2b61138badfeeb003630f7862b5f3f36358e217597c4d454e3f

SHA512
e19b6c1d153417c6a40738917a2313b983c4797b9ac0ce1914f5699f95c06d2c950bf2d2a81997f8fb405a711c6fa5e72fdf547726579915b2cfa4c4bd622a83

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
8.1MB

MD5
5884acc540c3b0ec677b71ffe81e2488

SHA1
5d2f302bed8e63920d8de237873466ab7f5f6632

SHA256
7dd0b812e1a1ec0ef816d0baf53de42f614409488a7a56cc0c4f53bf906378d9

SHA512
a57e87cd6c4796927ca2ed8d792b893040b100e266e190323074f837d1e9ea846f9fdd2b7648aa9489b9cc1ffaaed226f4445df4fe6ed29caea5db7247ca5c59

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
7.9MB

MD5
e0d93455ea9785afb55e2ed39b4700fa

SHA1
4f9d5c8332675d669334f8848e69c1570285d84e

SHA256
57d29981e510d98788627af34c065f550c6edf936aa393723b6d6624bbe16220

SHA512
3ac4801a1df5ef0f17752808a6eb01f86ace3830d7d1ffe4946786f7cf0499310feaa83a2be75055978470deac1cd7595d93d50e1c9a8cf7885fb2e58f21e6e8

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
8.1MB

MD5
830faab6919fe243f4bdcadb596cab1a

SHA1
d234c5a280790543194b246ca1e7526b315fd5a2

SHA256
b7506366eb922101189c9d9d45bec671d8fc0a92518868c7e1e4fa2f9a18714d

SHA512
df867609a717a841d6d56c3ae651b64e8b89d8cfb4cc0be3df65e11008c295a024bc938df14de08888973491b0ad50af7e53ed980982b39411c01bcde1504e0c

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
7.4MB

MD5
4bdee9757afaae0b7a0bd37ad1f150e6

SHA1
6534a1ff5a9eed704ed66309335ff7315b68d658

SHA256
40ea821bff346d01c53569611ad58e15c2d078a50e5ebd58170b873f53f8cf24

SHA512
a4cc52811357a8bee258ece707cb587104b6b9635fd34dc2527ba261a91da5ee5e8fdbb567948807c3a0b1765d42aa1964c8f32ef2b8fbda210e5c5315a74a35

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
7.0MB

MD5
1070097faa12a39fc2bf641333ceadcd

SHA1
0274d58cb6f0ca47fb7be4d86630e1f5b42b329e

SHA256
65dc598aca7c2519275b4cc8cdafe7f585892a6d00c90b73cd963b4ab4dca6cc

SHA512
1adbe009f644212c35be769589929630d989b97139d0873bf61820b961e8c53674c37b5be9e2c402120bd18c5f432f3b2691b09157010255b414da20ad8ecae6

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.6MB

MD5
45a42ad02f5e5772d38d440b17383340

SHA1
df3935a7632202bbe1a03d4aa503e9d6e7499965

SHA256
eb9aae480f5ad41b2e3d5080e62a2b60e0c0638b7710df70ef882e3ba17c4aab

SHA512
fac60aa1600582232f6c9cf4460f50e7b579a4c546dd938e39f872b6d1837326d37d5ad19730cc65a0fe9979ae3a27c274c2f69361428aa914c940067843846b

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
7.6MB

MD5
60d20b1ca40486405822f6ae8d1f81fa

SHA1
0e3f5f461a1f994075b179dcaaf317e155212a50

SHA256
8794b010cf0488b03b5a436f952ab2ebe2217602f40b61cd1480120fbbe24cf3

SHA512
4ff6c02c67e619c7e7717f07c9091f9137c3c8243f4841f6f01607b7baeb696beebb54e6774782270d05fe233eab5921f232f716c83534ad007408f2061dc1d4

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.4MB

MD5
265055a4ed2241e91cedb12856648bfa

SHA1
8a3ab80e7fcaba1b1c55e759ce514e98d12c4a2c

SHA256
99c8958737143570940e70d3cb7f9884f402144735c28ae2cc1ecae20a443c5e

SHA512
1c49609d6dec4e21eedc3cb015993e1dd17096a0fc8250a651e66e7f52a8a14a564c4ec5d57c4465d467c91bf3b884e30e120b61df15612742d77f141e8eeadf

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.9MB

MD5
6003d3ea51cfbda7e61385cca1bab3a6

SHA1
002950ff8c559b1593331e69a1d1a44f93a12cf1

SHA256
9c36c114ce217f38e5d8bbfc59d7e157b3ccc8c1d50983e722e91911b1ca6c0b

SHA512
d681dfb8380274aaa8103787e7d40c26aa27d1028b3a0650826e004b2d70b4ac401d01884d85164e68afdacc3df2b8138b9060ad760a875076934d873a1eecbe

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
6.9MB

MD5
112cc5ea9508cea00644dc449f487ff7

SHA1
c00a5706f518f7560f523fdeff69b824c48902af

SHA256
495c9af0f2effdaea42ce21e7292e426267c776527e93aa503f9ffbc2cd8dbdf

SHA512
d11237c9d1284f8e81a8ae76cfccf4c479d273bc4bd7b1c9449acf154d26543fe71a5cf2caaad3ec3d3976c8d41a8b017792075808e38e018b733b1ed0e308bb

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
5.9MB

MD5
0006d0744bf3f1be4d96d82c9525f7a0

SHA1
5567f6b5195a933bc2d637cea91da69510459e3c

SHA256
ad33f56678e350cdb33f6247bd9b986aeaf6aa02bd032ebbe3538f7470247ea5

SHA512
c81cc674a5d2ae067ab3f5716a54ec16a05facacc99b81a4742d78150fbdc8417fa5859cf617db4ee0b533a2479bd0fb94aecd6f83122df435bf588348650239

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
7.3MB

MD5
fc21a7ebe1dbc7460599b5ed9ea16f1c

SHA1
f2d30cb88079040d03f3118eb0eea05ca3d8c0fc

SHA256
ef78c7438563885478a5e99ac35a0bc372b164bbdf80c7edb96eceec32c70af0

SHA512
1600501c5fddfe66e08701c80fbc417c9106653d9d569d72ac5c5e5d7791098d59cf36f95cc56721b71dc3f73e0381365213a3d0f061a48be71b36d66f1f637b

Download Submit
memory/888-81-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/944-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/944-35-0x00000000004C0000-0x0000000000589000-memory.dmp

Filesize
804KB

Download
memory/944-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/944-37-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1200-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1200-6-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1200-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1200-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1200-25-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1200-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1200-3-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1296-32-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1296-38-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1296-56-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1296-34-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1296-33-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1296-31-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2264-47-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2716-67-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2716-68-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2928-106-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3924-96-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4216-63-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4216-62-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4216-80-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4524-103-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4548-70-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/5112-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5112-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5112-16-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download