warzonerat | 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/01/2025, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
Size

2.9MB
MD5

b8a6ac066c127db6bdd8d30d128ce9e9
SHA1

b22692a1e2ace7f6c770d2d73873c6dbb0538bf9
SHA256

1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e
SHA512

bdad9f7f16baadfff81992fc274eb64c3a3ed4c0b4f5f7b753d5df8bf59a5f616d317d1a1c9694b85aa3ffabcf52a4ee15b5260eecb9341ee39d55d53e2a4295
SSDEEP

24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH0:ATU7AAmw4gxeOw46fUbNecCCFbNecd

Score

10^/10

warzonerat discovery evasion infostealer persistence rat upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x00080000000173a9-88.dat	warzonerat
behavioral1/files/0x0008000000017079-171.dat	warzonerat
behavioral1/files/0x0008000000017488-183.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 27 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
1700	explorer.exe
2652	explorer.exe
1716	explorer.exe
1536	spoolsv.exe
3028	spoolsv.exe
3032	spoolsv.exe
1588	spoolsv.exe
2556	spoolsv.exe
2548	spoolsv.exe
1580	spoolsv.exe
1424	spoolsv.exe
592	spoolsv.exe
2084	spoolsv.exe
852	spoolsv.exe
1120	spoolsv.exe
1516	spoolsv.exe
2452	spoolsv.exe
2680	spoolsv.exe
2676	spoolsv.exe
3024	spoolsv.exe
816	spoolsv.exe
2760	spoolsv.exe
2896	spoolsv.exe
2180	spoolsv.exe
3004	spoolsv.exe
1780	spoolsv.exe
908	spoolsv.exe
2712	spoolsv.exe
1956	spoolsv.exe
2672	spoolsv.exe
2020	spoolsv.exe
1664	spoolsv.exe
2876	spoolsv.exe
2028	spoolsv.exe
2188	spoolsv.exe
444	spoolsv.exe
2352	spoolsv.exe
852	spoolsv.exe
836	spoolsv.exe
1656	spoolsv.exe
1928	spoolsv.exe
2240	spoolsv.exe
2668	spoolsv.exe
2396	spoolsv.exe
1684	spoolsv.exe
3016	spoolsv.exe
2856	spoolsv.exe
540	spoolsv.exe
708	spoolsv.exe
2620	spoolsv.exe
2040	spoolsv.exe
2072	spoolsv.exe
1640	spoolsv.exe
2800	spoolsv.exe
576	spoolsv.exe
984	spoolsv.exe
1664	spoolsv.exe
2916	spoolsv.exe
1720	spoolsv.exe
944	explorer.exe
2028	spoolsv.exe
2224	spoolsv.exe
1944	spoolsv.exe
760	explorer.exe

Loads dropped DLL 64 IoCs

pid	Process
2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
1716	explorer.exe
1716	explorer.exe
1536	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
3032	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2556	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
1580	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
592	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
852	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
1516	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2680	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
3024	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2760	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2180	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
1780	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2712	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2672	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
1664	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2028	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
444	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
852	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
1656	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
2240	spoolsv.exe
1716	explorer.exe
1716	explorer.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2660 set thread context of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 set thread context of 1724	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	34
PID 1700 set thread context of 2652	1700	explorer.exe	38
PID 2652 set thread context of 1716	2652	explorer.exe	39
PID 2652 set thread context of 1740	2652	explorer.exe	40
PID 1536 set thread context of 3028	1536	spoolsv.exe	44
PID 3032 set thread context of 1588	3032	spoolsv.exe	47
PID 2556 set thread context of 2548	2556	spoolsv.exe	51
PID 1580 set thread context of 1424	1580	spoolsv.exe	55
PID 592 set thread context of 2084	592	spoolsv.exe	58
PID 852 set thread context of 1120	852	spoolsv.exe	63
PID 1516 set thread context of 2452	1516	spoolsv.exe	67
PID 2680 set thread context of 2676	2680	spoolsv.exe	71
PID 3024 set thread context of 816	3024	spoolsv.exe	75
PID 2760 set thread context of 2896	2760	spoolsv.exe	79
PID 2180 set thread context of 3004	2180	spoolsv.exe	83
PID 1780 set thread context of 908	1780	spoolsv.exe	87
PID 2712 set thread context of 1956	2712	spoolsv.exe	91
PID 2672 set thread context of 2020	2672	spoolsv.exe	95
PID 1664 set thread context of 2876	1664	spoolsv.exe	99
PID 2028 set thread context of 2188	2028	spoolsv.exe	103
PID 444 set thread context of 2352	444	spoolsv.exe	107
PID 852 set thread context of 836	852	spoolsv.exe	111
PID 1656 set thread context of 1928	1656	spoolsv.exe	115
PID 2240 set thread context of 2668	2240	spoolsv.exe	119
PID 2396 set thread context of 1684	2396	spoolsv.exe	123
PID 3016 set thread context of 2856	3016	spoolsv.exe	127
PID 540 set thread context of 708	540	spoolsv.exe	131
PID 2620 set thread context of 2040	2620	spoolsv.exe	135
PID 2072 set thread context of 1640	2072	spoolsv.exe	138
PID 2800 set thread context of 576	2800	spoolsv.exe	142
PID 984 set thread context of 1664	984	spoolsv.exe	146
PID 3028 set thread context of 1720	3028	spoolsv.exe	150
PID 3028 set thread context of 1936	3028	spoolsv.exe	151
PID 2916 set thread context of 2028	2916	spoolsv.exe	153
PID 1588 set thread context of 1944	1588	spoolsv.exe	159
PID 944 set thread context of 760	944	explorer.exe	156
PID 1588 set thread context of 1992	1588	spoolsv.exe	160
PID 2224 set thread context of 2832	2224	spoolsv.exe	162
PID 1856 set thread context of 3012	1856	spoolsv.exe	166
PID 2548 set thread context of 1444	2548	spoolsv.exe	169
PID 2548 set thread context of 1484	2548	spoolsv.exe	170
PID 804 set thread context of 1788	804	spoolsv.exe	173
PID 2356 set thread context of 880	2356	explorer.exe	175
PID 1424 set thread context of 2952	1424	spoolsv.exe	177
PID 1424 set thread context of 280	1424	spoolsv.exe	179
PID 2808 set thread context of 2096	2808	spoolsv.exe	181
PID 2084 set thread context of 1560	2084	spoolsv.exe	182
PID 2084 set thread context of 1796	2084	spoolsv.exe	183
PID 2240 set thread context of 2672	2240	spoolsv.exe	190
PID 1120 set thread context of 604	1120	spoolsv.exe	193
PID 1120 set thread context of 1628	1120	spoolsv.exe	194
PID 2900 set thread context of 2760	2900	explorer.exe	195
PID 2068 set thread context of 2960	2068	spoolsv.exe	196
PID 2452 set thread context of 540	2452	spoolsv.exe	199
PID 1500 set thread context of 2480	1500	spoolsv.exe	201
PID 2452 set thread context of 1036	2452	spoolsv.exe	200
PID 2676 set thread context of 2528	2676	spoolsv.exe	205
PID 2676 set thread context of 3064	2676	spoolsv.exe	207
PID 1320 set thread context of 2736	1320	spoolsv.exe	206
PID 816 set thread context of 984	816	spoolsv.exe	214
PID 816 set thread context of 496	816	spoolsv.exe	215
PID 2176 set thread context of 2268	2176	explorer.exe	216

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2124-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2124-41-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/files/0x00080000000173a9-88.dat	upx
behavioral1/memory/1700-101-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/files/0x0008000000017079-171.dat	upx
behavioral1/files/0x0008000000017488-183.dat	upx
behavioral1/memory/1536-195-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3032-252-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2556-305-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1580-361-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2556-349-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/592-416-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/852-471-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1516-529-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2680-584-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1716-643-0x0000000001EB0000-0x0000000001EF6000-memory.dmp	upx
behavioral1/memory/3024-641-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2760-700-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2180-753-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Windows directory 45 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
1700	explorer.exe
1536	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
3032	spoolsv.exe
1716	explorer.exe
2556	spoolsv.exe
1716	explorer.exe
1580	spoolsv.exe
1716	explorer.exe
592	spoolsv.exe
1716	explorer.exe
852	spoolsv.exe
1716	explorer.exe
1516	spoolsv.exe
1716	explorer.exe
2680	spoolsv.exe
1716	explorer.exe
3024	spoolsv.exe
1716	explorer.exe
2760	spoolsv.exe
1716	explorer.exe
2180	spoolsv.exe
1716	explorer.exe
1780	spoolsv.exe
1716	explorer.exe
2712	spoolsv.exe
1716	explorer.exe
2672	spoolsv.exe
1716	explorer.exe
1664	spoolsv.exe
1716	explorer.exe
2028	spoolsv.exe
1716	explorer.exe
444	spoolsv.exe
1716	explorer.exe
852	spoolsv.exe
1716	explorer.exe
1656	spoolsv.exe
1716	explorer.exe
2240	spoolsv.exe
1716	explorer.exe
2396	spoolsv.exe
1716	explorer.exe
3016	spoolsv.exe
1716	explorer.exe
540	spoolsv.exe
1716	explorer.exe
2620	spoolsv.exe
1716	explorer.exe
2072	spoolsv.exe
1716	explorer.exe
2800	spoolsv.exe
1716	explorer.exe
984	spoolsv.exe
1716	explorer.exe
2916	spoolsv.exe
944	explorer.exe
1716	explorer.exe
2224	spoolsv.exe
1716	explorer.exe
1856	spoolsv.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
1700	explorer.exe
1700	explorer.exe
1716	explorer.exe
1716	explorer.exe
1536	spoolsv.exe
1536	spoolsv.exe
1716	explorer.exe
1716	explorer.exe
3032	spoolsv.exe
3032	spoolsv.exe
2556	spoolsv.exe
2556	spoolsv.exe
1580	spoolsv.exe
1580	spoolsv.exe
592	spoolsv.exe
592	spoolsv.exe
852	spoolsv.exe
852	spoolsv.exe
1516	spoolsv.exe
1516	spoolsv.exe
2680	spoolsv.exe
2680	spoolsv.exe
3024	spoolsv.exe
3024	spoolsv.exe
2760	spoolsv.exe
2760	spoolsv.exe
2180	spoolsv.exe
2180	spoolsv.exe
1780	spoolsv.exe
1780	spoolsv.exe
2712	spoolsv.exe
2712	spoolsv.exe
2672	spoolsv.exe
2672	spoolsv.exe
1664	spoolsv.exe
1664	spoolsv.exe
2028	spoolsv.exe
2028	spoolsv.exe
444	spoolsv.exe
444	spoolsv.exe
852	spoolsv.exe
852	spoolsv.exe
1656	spoolsv.exe
1656	spoolsv.exe
2240	spoolsv.exe
2240	spoolsv.exe
2396	spoolsv.exe
2396	spoolsv.exe
3016	spoolsv.exe
3016	spoolsv.exe
540	spoolsv.exe
540	spoolsv.exe
2620	spoolsv.exe
2620	spoolsv.exe
2072	spoolsv.exe
2072	spoolsv.exe
2800	spoolsv.exe
2800	spoolsv.exe
984	spoolsv.exe
984	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2696	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	30
PID 2124 wrote to memory of 2696	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	30
PID 2124 wrote to memory of 2696	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	30
PID 2124 wrote to memory of 2696	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	30
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2124 wrote to memory of 2660	2124	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	32
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 2088	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	33
PID 2660 wrote to memory of 1724	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	34
PID 2660 wrote to memory of 1724	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	34
PID 2660 wrote to memory of 1724	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	34
PID 2660 wrote to memory of 1724	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	34
PID 2660 wrote to memory of 1724	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	34
PID 2660 wrote to memory of 1724	2660	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	34
PID 2088 wrote to memory of 1700	2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	35
PID 2088 wrote to memory of 1700	2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	35
PID 2088 wrote to memory of 1700	2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	35
PID 2088 wrote to memory of 1700	2088	1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe	35
PID 1700 wrote to memory of 1484	1700	explorer.exe	36
PID 1700 wrote to memory of 1484	1700	explorer.exe	36
PID 1700 wrote to memory of 1484	1700	explorer.exe	36
PID 1700 wrote to memory of 1484	1700	explorer.exe	36
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38
PID 1700 wrote to memory of 2652	1700	explorer.exe	38

C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
"C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
  C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
    C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:1484
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2652
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        Executes dropped EXE
        
        PID:1720
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        
        PID:2036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1936
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1848
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1588
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1992
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:3000
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2548
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        
        PID:2868
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:880
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1376
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:280
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2180
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1796
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:836
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1120
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:604
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1628
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2452
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:540
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1036
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2676
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2528
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:3064
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2160
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:816
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:984
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:496
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2868
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2896
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2472
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:908
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:992
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2732
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2188
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1132
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1776
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:836
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2784
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2668
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2648
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1684
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:332
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:708
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2832
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1640
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2664
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:576
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2780
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1664
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:332
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:568
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1764
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2764
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1036
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2552
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:804
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:3056
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2480
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:3068
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2736
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:588
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1740
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
b8a6ac066c127db6bdd8d30d128ce9e9

SHA1
b22692a1e2ace7f6c770d2d73873c6dbb0538bf9

SHA256
1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e

SHA512
bdad9f7f16baadfff81992fc274eb64c3a3ed4c0b4f5f7b753d5df8bf59a5f616d317d1a1c9694b85aa3ffabcf52a4ee15b5260eecb9341ee39d55d53e2a4295

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
203e7101a76f83f95da6c503e2edcbba

SHA1
d6a1eb68dd8a160c3efc302745193a09ca5589f2

SHA256
15f6d1ce66bdcba6def77d26cad692a2f3c923642231f3631daf650a6af193b7

SHA512
6dbc5ba2ef00cafa107358ce218a9d37d4750e77c7803a5626e9de5583030ce045445d1f6567b97b0054cdea037f85fcbbefed1447aaa9c625ffd5664a4e7a59

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
5df9c936b07b07f64668027f275133bd

SHA1
7ea00e106fa058212d1fa5ffe42b3c3bed8fb1d2

SHA256
f88f514c1153e3a778bf091d2e2fa8b51e234f4d2d0e1560f025c199e3bd2959

SHA512
0faca5a5aca955ab9811d0b297c9383fa9a2d7ed2621801b48ebc29ef9b776d15c465b4d054cdf3762bf4e6c22ef176d1619e059f4d8c949c0c1ff13432f922a

Download Submit
memory/592-416-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/592-431-0x0000000001D90000-0x0000000001DD6000-memory.dmp

Filesize
280KB

Download
memory/816-2356-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/816-694-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/852-482-0x00000000002D0000-0x0000000000316000-memory.dmp

Filesize
280KB

Download
memory/852-471-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1120-523-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1120-2107-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1424-1925-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1424-409-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1516-529-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1536-195-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1580-361-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1588-1698-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1588-300-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1700-101-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1716-749-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-250-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-642-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-643-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-583-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-365-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-366-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-528-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-639-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-699-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-698-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-465-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-430-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-350-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-360-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-304-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-1011-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-249-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-748-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-640-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-472-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-990-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-194-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-752-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-751-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-850-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-470-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1716-849-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

Filesize
280KB

Download
memory/1724-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1724-90-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2084-466-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2084-1996-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2088-73-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-98-0x0000000002690000-0x00000000026D6000-memory.dmp

Filesize
280KB

Download
memory/2088-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-151-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-97-0x0000000002650000-0x0000000002696000-memory.dmp

Filesize
280KB

Download
memory/2124-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2124-41-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2180-753-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2180-764-0x0000000001CF0000-0x0000000001D36000-memory.dmp

Filesize
280KB

Download
memory/2452-579-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2452-2240-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2548-355-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2548-1832-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2556-305-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2556-349-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2652-152-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2652-651-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2660-15-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-14-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-86-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2660-67-0x0000000007130000-0x0000000007176000-memory.dmp

Filesize
280KB

Download
memory/2660-51-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2660-19-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-5-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-43-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2660-46-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2660-2-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2660-42-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-40-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2660-7-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-9-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-11-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-48-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2660-45-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-47-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-22-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-17-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2660-24-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-26-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-28-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-30-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-32-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-49-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2660-36-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2660-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2676-635-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2676-2287-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2680-594-0x0000000001D70000-0x0000000001DB6000-memory.dmp

Filesize
280KB

Download
memory/2680-584-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2760-707-0x00000000004D0000-0x0000000000516000-memory.dmp

Filesize
280KB

Download
memory/2760-700-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2896-747-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3024-641-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3028-1581-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3028-251-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3032-252-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3032-269-0x0000000000450000-0x0000000000496000-memory.dmp

Filesize
280KB

Download