warzonerat | dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822d

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
Size

8.2MB
MD5

de399ee5f64c1f9510ade80df9dcee80
SHA1

7902c4ae51e346105653482db4d4be2aa1cc35f2
SHA256

dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822d
SHA512

872b0115be83ab59cc76a40a88b65aca8e834aa6a77d5ba652989dd0f01312a3aedba0427da8c62f4d0745b0e0d409715eed948cd8438caff0b858523733ea9d
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNeco:V8e8e8f8e8e8D

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/files/0x000c000000023b98-25.dat	warzonerat
behavioral2/files/0x000b000000023b96-47.dat	warzonerat
behavioral2/files/0x00030000000221eb-59.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c000000023b98-25.dat	aspack_v212_v242
behavioral2/files/0x000b000000023b96-47.dat	aspack_v212_v242
behavioral2/files/0x00030000000221eb-59.dat	aspack_v212_v242

Executes dropped EXE 64 IoCs

pid	Process
4340	explorer.exe
4504	explorer.exe
1292	spoolsv.exe
2172	spoolsv.exe
4312	spoolsv.exe
1344	spoolsv.exe
2040	spoolsv.exe
1580	spoolsv.exe
4788	spoolsv.exe
3460	spoolsv.exe
3328	spoolsv.exe
1096	spoolsv.exe
2088	spoolsv.exe
1156	spoolsv.exe
3968	spoolsv.exe
4192	spoolsv.exe
3952	spoolsv.exe
2232	spoolsv.exe
1008	spoolsv.exe
2500	spoolsv.exe
3020	spoolsv.exe
4500	spoolsv.exe
184	spoolsv.exe
2020	spoolsv.exe
4360	spoolsv.exe
3936	spoolsv.exe
1436	spoolsv.exe
2400	spoolsv.exe
3096	spoolsv.exe
1080	spoolsv.exe
4020	spoolsv.exe
5012	spoolsv.exe
3212	spoolsv.exe
2224	spoolsv.exe
3828	spoolsv.exe
5016	spoolsv.exe
3776	spoolsv.exe
3040	spoolsv.exe
1868	spoolsv.exe
1384	spoolsv.exe
1224	spoolsv.exe
5088	spoolsv.exe
1340	spoolsv.exe
1012	spoolsv.exe
4384	spoolsv.exe
2276	spoolsv.exe
4920	spoolsv.exe
1812	spoolsv.exe
1400	spoolsv.exe
2996	spoolsv.exe
2164	spoolsv.exe
1724	spoolsv.exe
2408	spoolsv.exe
856	spoolsv.exe
3612	spoolsv.exe
648	spoolsv.exe
3012	spoolsv.exe
3044	spoolsv.exe
3392	spoolsv.exe
2172	spoolsv.exe
1992	spoolsv.exe
2416	spoolsv.exe
4224	spoolsv.exe
3204	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4044 set thread context of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 set thread context of 4256	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	100
PID 4340 set thread context of 4504	4340	explorer.exe	102

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4028	2172	WerFault.exe	105
456	4312	WerFault.exe	110
4332	1344	WerFault.exe	113
1620	2040	WerFault.exe	116
2220	1580	WerFault.exe	119
1416	4788	WerFault.exe	122
2072	3460	WerFault.exe	125
3800	3328	WerFault.exe	128
844	1096	WerFault.exe	131
2312	2088	WerFault.exe	134
2016	1156	WerFault.exe	137
3060	3968	WerFault.exe	140
948	4192	WerFault.exe	143
5036	3952	WerFault.exe	146
4024	2232	WerFault.exe	149
4728	1008	WerFault.exe	152
1440	2500	WerFault.exe	155
3480	3020	WerFault.exe	158
4552	4500	WerFault.exe	161
2912	184	WerFault.exe	164
1724	2020	WerFault.exe	167
536	4360	WerFault.exe	170
4872	3936	WerFault.exe	173
376	1436	WerFault.exe	176
4408	2400	WerFault.exe	179
3012	3096	WerFault.exe	182
3044	1080	WerFault.exe	185
456	4020	WerFault.exe	188
3980	5012	WerFault.exe	191
3504	3212	WerFault.exe	194
2416	2224	WerFault.exe	197
4908	3828	WerFault.exe	200
3604	5016	WerFault.exe	203
1828	3776	WerFault.exe	206
4848	3040	WerFault.exe	209
1096	1868	WerFault.exe	212
3420	1384	WerFault.exe	215
2016	1224	WerFault.exe	218
3060	5088	WerFault.exe	221
948	1340	WerFault.exe	224
4416	1012	WerFault.exe	227
932	4384	WerFault.exe	230
804	2276	WerFault.exe	233
808	4920	WerFault.exe	236
860	1812	WerFault.exe	239
1388	1400	WerFault.exe	242
3688	2996	WerFault.exe	245
3324	2164	WerFault.exe	248
4900	1724	WerFault.exe	251
1560	2408	WerFault.exe	254
3380	856	WerFault.exe	257
1700	3612	WerFault.exe	260
2288	648	WerFault.exe	263
4724	3012	WerFault.exe	266
3956	3044	WerFault.exe	269
4996	3392	WerFault.exe	272
4768	2172	WerFault.exe	275
2188	1992	WerFault.exe	278
2184	2416	WerFault.exe	281
2260	4224	WerFault.exe	284
1368	3204	WerFault.exe	287
3328	3648	WerFault.exe	290
2640	4832	WerFault.exe	293
2208	2284	WerFault.exe	296

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4492	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
4492	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4492	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
4492	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe
4504	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4492	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	99
PID 4044 wrote to memory of 4256	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	100
PID 4044 wrote to memory of 4256	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	100
PID 4044 wrote to memory of 4256	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	100
PID 4044 wrote to memory of 4256	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	100
PID 4044 wrote to memory of 4256	4044	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	100
PID 4492 wrote to memory of 4340	4492	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	101
PID 4492 wrote to memory of 4340	4492	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	101
PID 4492 wrote to memory of 4340	4492	dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe	101
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 4504	4340	explorer.exe	102
PID 4340 wrote to memory of 2400	4340	explorer.exe	103
PID 4340 wrote to memory of 2400	4340	explorer.exe	103
PID 4340 wrote to memory of 2400	4340	explorer.exe	103
PID 4504 wrote to memory of 1292	4504	explorer.exe	104
PID 4504 wrote to memory of 1292	4504	explorer.exe	104
PID 4504 wrote to memory of 1292	4504	explorer.exe	104
PID 4504 wrote to memory of 2172	4504	explorer.exe	105
PID 4504 wrote to memory of 2172	4504	explorer.exe	105
PID 4504 wrote to memory of 2172	4504	explorer.exe	105
PID 4504 wrote to memory of 4312	4504	explorer.exe	110
PID 4504 wrote to memory of 4312	4504	explorer.exe	110
PID 4504 wrote to memory of 4312	4504	explorer.exe	110
PID 4504 wrote to memory of 1344	4504	explorer.exe	113
PID 4504 wrote to memory of 1344	4504	explorer.exe	113
PID 4504 wrote to memory of 1344	4504	explorer.exe	113
PID 4504 wrote to memory of 2040	4504	explorer.exe	116
PID 4504 wrote to memory of 2040	4504	explorer.exe	116
PID 4504 wrote to memory of 2040	4504	explorer.exe	116
PID 4504 wrote to memory of 1580	4504	explorer.exe	119
PID 4504 wrote to memory of 1580	4504	explorer.exe	119
PID 4504 wrote to memory of 1580	4504	explorer.exe	119
PID 4504 wrote to memory of 4788	4504	explorer.exe	122
PID 4504 wrote to memory of 4788	4504	explorer.exe	122
PID 4504 wrote to memory of 4788	4504	explorer.exe	122
PID 4504 wrote to memory of 3460	4504	explorer.exe	125
PID 4504 wrote to memory of 3460	4504	explorer.exe	125
PID 4504 wrote to memory of 3460	4504	explorer.exe	125
PID 4504 wrote to memory of 3328	4504	explorer.exe	128
PID 4504 wrote to memory of 3328	4504	explorer.exe	128
PID 4504 wrote to memory of 3328	4504	explorer.exe	128
PID 4504 wrote to memory of 1096	4504	explorer.exe	131
PID 4504 wrote to memory of 1096	4504	explorer.exe	131
PID 4504 wrote to memory of 1096	4504	explorer.exe	131
PID 4504 wrote to memory of 2088	4504	explorer.exe	134
PID 4504 wrote to memory of 2088	4504	explorer.exe	134
PID 4504 wrote to memory of 2088	4504	explorer.exe	134
PID 4504 wrote to memory of 1156	4504	explorer.exe	137
PID 4504 wrote to memory of 1156	4504	explorer.exe	137
PID 4504 wrote to memory of 1156	4504	explorer.exe	137
PID 4504 wrote to memory of 3968	4504	explorer.exe	140

C:\Users\Admin\AppData\Local\Temp\dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
"C:\Users\Admin\AppData\Local\Temp\dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Local\Temp\dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe
  "C:\Users\Admin\AppData\Local\Temp\dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822dN.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4492
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 200
        6⤵
        Program crash
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 192
        6⤵
        Program crash
        
        PID:456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 192
        6⤵
        Program crash
        
        PID:4332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 192
        6⤵
        Program crash
        
        PID:1620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 192
        6⤵
        Program crash
        
        PID:2220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 192
        6⤵
        Program crash
        
        PID:1416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 192
        6⤵
        Program crash
        
        PID:2072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 192
        6⤵
        Program crash
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 192
        6⤵
        Program crash
        
        PID:844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 192
        6⤵
        Program crash
        
        PID:2312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 192
        6⤵
        Program crash
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 192
        6⤵
        Program crash
        
        PID:3060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 192
        6⤵
        Program crash
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 192
        6⤵
        Program crash
        
        PID:5036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 192
        6⤵
        Program crash
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 192
        6⤵
        Program crash
        
        PID:4728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 192
        6⤵
        Program crash
        
        PID:1440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 192
        6⤵
        Program crash
        
        PID:3480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 192
        6⤵
        Program crash
        
        PID:4552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 192
        6⤵
        Program crash
        
        PID:2912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 200
        6⤵
        Program crash
        
        PID:1724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 192
        6⤵
        Program crash
        
        PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 192
        6⤵
        Program crash
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 192
        6⤵
        Program crash
        
        PID:376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 192
        6⤵
        Program crash
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 192
        6⤵
        Program crash
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1080
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 192
        6⤵
        Program crash
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 192
        6⤵
        Program crash
        
        PID:456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:5012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 192
        6⤵
        Program crash
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 192
        6⤵
        Program crash
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 192
        6⤵
        Program crash
        
        PID:2416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 192
        6⤵
        Program crash
        
        PID:4908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:5016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 192
        6⤵
        Program crash
        
        PID:3604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 192
        6⤵
        Program crash
        
        PID:1828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 192
        6⤵
        Program crash
        
        PID:4848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 192
        6⤵
        Program crash
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1384
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 192
        6⤵
        Program crash
        
        PID:3420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 192
        6⤵
        Program crash
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:5088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 192
        6⤵
        Program crash
        
        PID:3060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 192
        6⤵
        Program crash
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 192
        6⤵
        Program crash
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4384
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 192
        6⤵
        Program crash
        
        PID:932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 192
        6⤵
        Program crash
        
        PID:804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 192
        6⤵
        Program crash
        
        PID:808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 192
        6⤵
        Program crash
        
        PID:860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 192
        6⤵
        Program crash
        
        PID:1388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 192
        6⤵
        Program crash
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 192
        6⤵
        Program crash
        
        PID:3324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 192
        6⤵
        Program crash
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 192
        6⤵
        Program crash
        
        PID:1560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 192
        6⤵
        Program crash
        
        PID:3380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 192
        6⤵
        Program crash
        
        PID:1700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 192
        6⤵
        Program crash
        
        PID:2288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 192
        6⤵
        Program crash
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 192
        6⤵
        Program crash
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 192
        6⤵
        Program crash
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 192
        6⤵
        Program crash
        
        PID:4768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 192
        6⤵
        Program crash
        
        PID:2188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 192
        6⤵
        Program crash
        
        PID:2184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 192
        6⤵
        Program crash
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 192
        6⤵
        Program crash
        
        PID:1368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 192
        6⤵
        Program crash
        
        PID:3328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 192
        6⤵
        Program crash
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 192
        6⤵
        Program crash
        
        PID:2208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 192
        6⤵
        
        PID:1864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 192
        6⤵
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 192
        6⤵
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 192
        6⤵
        
        PID:2372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 192
        6⤵
        
        PID:428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 192
        6⤵
        
        PID:2828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 192
        6⤵
        
        PID:4456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 192
        6⤵
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 192
        6⤵
        
        PID:552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 192
        6⤵
        
        PID:4212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 192
        6⤵
        
        PID:1988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 192
        6⤵
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 192
        6⤵
        
        PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 192
        6⤵
        
        PID:1832
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:2400
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2172 -ip 2172
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4312 -ip 4312
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1344 -ip 1344
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2040 -ip 2040
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1580 -ip 1580
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4788 -ip 4788
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3460 -ip 3460
1⤵
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3328 -ip 3328
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1096 -ip 1096
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2088 -ip 2088
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1156 -ip 1156
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3968 -ip 3968
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4192 -ip 4192
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3952 -ip 3952
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2232 -ip 2232
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1008 -ip 1008
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2500 -ip 2500
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3020 -ip 3020
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4500 -ip 4500
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 184 -ip 184
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2020 -ip 2020
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4360 -ip 4360
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3936 -ip 3936
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1436 -ip 1436
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2400 -ip 2400
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3096 -ip 3096
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1080 -ip 1080
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4020 -ip 4020
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5012 -ip 5012
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3212 -ip 3212
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2224 -ip 2224
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3828 -ip 3828
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5016 -ip 5016
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3776 -ip 3776
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3040 -ip 3040
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1868 -ip 1868
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1384 -ip 1384
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1224 -ip 1224
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5088 -ip 5088
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1340 -ip 1340
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1012 -ip 1012
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4384 -ip 4384
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2276 -ip 2276
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4920 -ip 4920
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1812 -ip 1812
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1400 -ip 1400
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2996 -ip 2996
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2164 -ip 2164
1⤵
PID:184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1724 -ip 1724
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2408 -ip 2408
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 856 -ip 856
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3612 -ip 3612
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 648 -ip 648
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3012 -ip 3012
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3044 -ip 3044
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3392 -ip 3392
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2172 -ip 2172
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1992 -ip 1992
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2416 -ip 2416
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4224 -ip 4224
1⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3204 -ip 3204
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3648 -ip 3648
1⤵
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4832 -ip 4832
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2284 -ip 2284
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2312 -ip 2312
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4664 -ip 4664
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5112 -ip 5112
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1336 -ip 1336
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 388 -ip 388
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4740 -ip 4740
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4876 -ip 4876
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4392 -ip 4392
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 808 -ip 808
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2812 -ip 2812
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 748 -ip 748
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1380 -ip 1380
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2536 -ip 2536
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1724 -ip 1724
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
de399ee5f64c1f9510ade80df9dcee80

SHA1
7902c4ae51e346105653482db4d4be2aa1cc35f2

SHA256
dc537336e2cea4bd5132360dbe99748b5b56dbc4aa67265a5bbe5dd97d54822d

SHA512
872b0115be83ab59cc76a40a88b65aca8e834aa6a77d5ba652989dd0f01312a3aedba0427da8c62f4d0745b0e0d409715eed948cd8438caff0b858523733ea9d

Download Submit
C:\Windows\System\explorer.exe

Filesize
8.2MB

MD5
0a6154507cb3e0047e755e50d7e49632

SHA1
f1047e2f0d72b5e46b69cfc7d78d907aac20ac8e

SHA256
3568087320b11e51dbd61c055d60761ee6c6a1add6c6be4593a1d4175a9fd47e

SHA512
0eeceb5c08e110f62c02af212d8ceae86b2c561e695902c8c80483ddea718a1bfda30010d30a67486b7434a5c8ccf29c71429d8f2bb6d26ec7a7adce74f246f1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
8.2MB

MD5
1edd2024154bc1a1ae751e25c7d716bb

SHA1
8c101873556bca0acff6e49a4533737d50ab25ba

SHA256
9a7d66cbaee19f32c2ca1c3474f2b5fc5517b9afa4e355a45dd6399e0f7400f9

SHA512
f1a4ec09ca6393dfcd2c0a51228391fa21eb2de76121b39d3a3d5b94766a6ee196f06aa7dc1e4627ca23d179e97a8700c5c556ff6796cdd346fee01d2ba9392d

Download Submit
memory/808-137-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1292-62-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1292-78-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1292-61-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1384-110-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2088-79-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2172-66-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2276-118-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2400-97-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3044-132-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4044-6-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/4044-22-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4044-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4044-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4044-3-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/4044-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4044-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4256-20-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4256-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4256-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4312-68-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4340-55-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4340-36-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4340-32-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4340-31-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4340-30-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4340-29-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4492-35-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4492-33-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4492-13-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4492-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download