warzonerat | 87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
Size

8.9MB
MD5

4f507f36390e3941405eff5cf37e0170
SHA1

15a9717df6aff646c864ec33f68c01559ca0f789
SHA256

87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3
SHA512

ae6856da286ecab25c233fad180e4c01996bfb744a149ef424637fffc2f69cfce6269fc735609f09ef77aacdab30e1370505956e22709fc5d99a20274abe9bea
SSDEEP

49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecR:K1+8e8e8f8e8e8s

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/files/0x000b000000023bba-19.dat	warzonerat
behavioral2/files/0x0009000000023bb4-35.dat	warzonerat
behavioral2/files/0x000f00000002369a-51.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
1644	explorer.exe
392	explorer.exe
4784	spoolsv.exe
2988	spoolsv.exe
2412	spoolsv.exe
3528	spoolsv.exe
3264	spoolsv.exe
4536	spoolsv.exe
4968	spoolsv.exe
1700	spoolsv.exe
4220	spoolsv.exe
5116	spoolsv.exe
1828	spoolsv.exe
3356	spoolsv.exe
4588	spoolsv.exe
3900	spoolsv.exe
4484	spoolsv.exe
3520	spoolsv.exe
3168	spoolsv.exe
2852	spoolsv.exe
4808	spoolsv.exe
4140	spoolsv.exe
1204	spoolsv.exe
3740	spoolsv.exe
4800	spoolsv.exe
3724	spoolsv.exe
4616	spoolsv.exe
2024	spoolsv.exe
4932	spoolsv.exe
1824	spoolsv.exe
2228	spoolsv.exe
2496	spoolsv.exe
1144	spoolsv.exe
448	spoolsv.exe
3144	spoolsv.exe
848	spoolsv.exe
3200	spoolsv.exe
3192	spoolsv.exe
3668	spoolsv.exe
4744	spoolsv.exe
4544	spoolsv.exe
3024	spoolsv.exe
5108	spoolsv.exe
1420	spoolsv.exe
2660	spoolsv.exe
4892	spoolsv.exe
2860	spoolsv.exe
1848	spoolsv.exe
4676	spoolsv.exe
1524	spoolsv.exe
4380	spoolsv.exe
4188	spoolsv.exe
892	spoolsv.exe
2892	spoolsv.exe
3476	spoolsv.exe
4232	spoolsv.exe
3272	spoolsv.exe
1156	spoolsv.exe
3524	spoolsv.exe
4416	spoolsv.exe
1476	spoolsv.exe
4656	spoolsv.exe
3708	spoolsv.exe
3244	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 set thread context of 1780	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	92
PID 1644 set thread context of 392	1644	explorer.exe	94
PID 1644 set thread context of 3456	1644	explorer.exe	95

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
220	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
220	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
392	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
220	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
220	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe
392	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 220	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	91
PID 1596 wrote to memory of 1780	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	92
PID 1596 wrote to memory of 1780	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	92
PID 1596 wrote to memory of 1780	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	92
PID 1596 wrote to memory of 1780	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	92
PID 1596 wrote to memory of 1780	1596	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	92
PID 220 wrote to memory of 1644	220	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	93
PID 220 wrote to memory of 1644	220	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	93
PID 220 wrote to memory of 1644	220	87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe	93
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 392	1644	explorer.exe	94
PID 1644 wrote to memory of 3456	1644	explorer.exe	95
PID 1644 wrote to memory of 3456	1644	explorer.exe	95
PID 1644 wrote to memory of 3456	1644	explorer.exe	95
PID 1644 wrote to memory of 3456	1644	explorer.exe	95
PID 1644 wrote to memory of 3456	1644	explorer.exe	95
PID 392 wrote to memory of 4784	392	explorer.exe	96
PID 392 wrote to memory of 4784	392	explorer.exe	96
PID 392 wrote to memory of 4784	392	explorer.exe	96
PID 392 wrote to memory of 2988	392	explorer.exe	97
PID 392 wrote to memory of 2988	392	explorer.exe	97
PID 392 wrote to memory of 2988	392	explorer.exe	97
PID 392 wrote to memory of 2412	392	explorer.exe	98
PID 392 wrote to memory of 2412	392	explorer.exe	98
PID 392 wrote to memory of 2412	392	explorer.exe	98
PID 392 wrote to memory of 3528	392	explorer.exe	99
PID 392 wrote to memory of 3528	392	explorer.exe	99
PID 392 wrote to memory of 3528	392	explorer.exe	99
PID 392 wrote to memory of 3264	392	explorer.exe	100
PID 392 wrote to memory of 3264	392	explorer.exe	100
PID 392 wrote to memory of 3264	392	explorer.exe	100
PID 392 wrote to memory of 4536	392	explorer.exe	101
PID 392 wrote to memory of 4536	392	explorer.exe	101
PID 392 wrote to memory of 4536	392	explorer.exe	101
PID 392 wrote to memory of 4968	392	explorer.exe	102
PID 392 wrote to memory of 4968	392	explorer.exe	102
PID 392 wrote to memory of 4968	392	explorer.exe	102
PID 392 wrote to memory of 1700	392	explorer.exe	103
PID 392 wrote to memory of 1700	392	explorer.exe	103
PID 392 wrote to memory of 1700	392	explorer.exe	103
PID 392 wrote to memory of 4220	392	explorer.exe	104
PID 392 wrote to memory of 4220	392	explorer.exe	104
PID 392 wrote to memory of 4220	392	explorer.exe	104
PID 392 wrote to memory of 5116	392	explorer.exe	105
PID 392 wrote to memory of 5116	392	explorer.exe	105
PID 392 wrote to memory of 5116	392	explorer.exe	105
PID 392 wrote to memory of 1828	392	explorer.exe	106
PID 392 wrote to memory of 1828	392	explorer.exe	106
PID 392 wrote to memory of 1828	392	explorer.exe	106
PID 392 wrote to memory of 3356	392	explorer.exe	107
PID 392 wrote to memory of 3356	392	explorer.exe	107

C:\Users\Admin\AppData\Local\Temp\87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
"C:\Users\Admin\AppData\Local\Temp\87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe
  "C:\Users\Admin\AppData\Local\Temp\87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3N.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:220
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:5108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:64
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5272
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:3456
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.9MB

MD5
4f507f36390e3941405eff5cf37e0170

SHA1
15a9717df6aff646c864ec33f68c01559ca0f789

SHA256
87290a122227a323a441974647abfd13bacf1aac40d7402145308a6488bea2a3

SHA512
ae6856da286ecab25c233fad180e4c01996bfb744a149ef424637fffc2f69cfce6269fc735609f09ef77aacdab30e1370505956e22709fc5d99a20274abe9bea

Download Submit
C:\Windows\System\explorer.exe

Filesize
8.9MB

MD5
d62459984c2d45ef9851b2d5dcce90fc

SHA1
4934e4ce5f28a19ed4b5a84aa3726542106bba48

SHA256
5ca666e468899d02d640b4a83e203911305c81a6cf386863589e66002b201646

SHA512
9bbe0a9e2e4b5da28069ff0395bcd97cafdf25d790f77040d11b9bf7378b3fd0bc8e124ced82feb2f6dcd4404672b2c3dbd14b74900226e79eeab70cedeb5a2d

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
8.9MB

MD5
ad1deb6e3d926e99f27919a74c6179c0

SHA1
ec5fdfbb1d378665672161688b0fc8ddc56a558d

SHA256
ba0b1e4d8fb8c48a03f1a52a031e75b8fdcc05f393a6bcaaac2d9190b73f22dd

SHA512
c68d4f6ab0550628f738e4a3fa5143df5d1ab4599c69e2583652d74f0b84848714b2896048a3c816e61ff01132cfc4ad9a7889cde30061633daa60eca598066d

Download Submit
memory/220-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-25-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/392-37-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/392-62-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/448-141-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/448-118-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/848-145-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/892-162-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/892-180-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1144-139-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1156-186-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1204-115-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1280-195-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1420-164-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1476-190-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1524-177-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1596-3-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1596-1-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1596-17-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1596-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1596-2-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1644-46-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1644-28-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1644-24-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1644-23-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1700-82-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1780-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1780-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1780-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1824-131-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1828-90-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1844-185-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1848-173-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2024-127-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2024-103-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2180-194-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2228-111-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2228-133-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2412-71-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2496-136-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2660-167-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2832-188-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2852-83-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2852-108-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2860-171-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2892-165-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2892-181-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2988-69-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3024-159-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3024-137-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3144-143-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3168-105-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3192-150-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3200-147-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3200-125-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3244-193-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3264-75-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3272-184-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3356-92-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3456-44-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3476-182-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3520-102-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3520-78-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3524-187-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3528-73-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3528-58-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3668-152-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3708-192-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3724-98-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3724-122-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3740-117-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3900-97-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4140-88-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4140-113-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4188-179-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4220-85-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4232-183-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4380-157-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4380-178-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4416-189-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4484-100-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4536-77-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4544-156-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4544-134-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4588-95-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4616-124-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4656-191-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4676-175-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4744-154-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4784-66-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4784-52-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4800-120-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4808-110-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4892-169-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4932-129-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4932-106-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4968-80-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/5108-161-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/5116-87-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download