warzonerat | c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/01/2025, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
Size

2.9MB
MD5

8221efe81c93c9b232d597add4e11d61
SHA1

46b631a99272293f029f41323959ab29d1317b76
SHA256

c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd
SHA512

ea3dea30a683c3ba669c3a4dceaede8229781ad84cebc254205ecc21469a2b0defd9be8a769debd05ca04bdb39955e5b3d01cfc81c98a37e22ccd4b6d0e409c4
SSDEEP

24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHG:ATU7AAmw4gxeOw46fUbNecCCFbNec9

Score

10^/10

warzonerat discovery evasion infostealer persistence rat upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x0008000000015c0d-87.dat	warzonerat
behavioral1/files/0x0008000000015694-168.dat	warzonerat
behavioral1/files/0x00090000000156b5-184.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 17 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
2112	explorer.exe
840	explorer.exe
2180	explorer.exe
656	spoolsv.exe
944	spoolsv.exe
2876	spoolsv.exe
2096	spoolsv.exe
2700	spoolsv.exe
1764	spoolsv.exe
2212	spoolsv.exe
2656	spoolsv.exe
1772	spoolsv.exe
1136	spoolsv.exe
2044	spoolsv.exe
540	spoolsv.exe
1708	spoolsv.exe
900	spoolsv.exe
2308	spoolsv.exe
2952	spoolsv.exe
2756	spoolsv.exe
1756	spoolsv.exe
3012	spoolsv.exe
2864	spoolsv.exe
1276	spoolsv.exe
1480	spoolsv.exe
2912	spoolsv.exe
1924	spoolsv.exe
288	spoolsv.exe
1172	spoolsv.exe
1960	spoolsv.exe
2384	spoolsv.exe
2696	spoolsv.exe
2868	spoolsv.exe
624	spoolsv.exe
1792	spoolsv.exe
1228	spoolsv.exe
2320	spoolsv.exe
680	spoolsv.exe
1672	spoolsv.exe
1780	spoolsv.exe
936	spoolsv.exe
2380	spoolsv.exe
696	spoolsv.exe
2896	spoolsv.exe
2832	spoolsv.exe
644	spoolsv.exe
2396	spoolsv.exe
1668	spoolsv.exe
1744	spoolsv.exe
768	spoolsv.exe
1440	spoolsv.exe
1348	spoolsv.exe
1780	spoolsv.exe
1968	spoolsv.exe
2484	spoolsv.exe
2824	spoolsv.exe
3036	spoolsv.exe
2068	spoolsv.exe
2628	spoolsv.exe
2852	spoolsv.exe
1972	spoolsv.exe
2528	spoolsv.exe
1044	spoolsv.exe
700	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
2180	explorer.exe
2180	explorer.exe
656	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2876	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2700	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2212	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
1772	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2044	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
1708	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2308	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2756	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
3012	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
1276	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2912	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
288	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
1960	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2696	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
624	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
1228	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
680	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
1780	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2380	spoolsv.exe
2180	explorer.exe
2180	explorer.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3036 set thread context of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 2436 set thread context of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 set thread context of 2192	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	35
PID 2112 set thread context of 840	2112	explorer.exe	39
PID 840 set thread context of 2180	840	explorer.exe	40
PID 840 set thread context of 1632	840	explorer.exe	41
PID 656 set thread context of 944	656	spoolsv.exe	45
PID 2876 set thread context of 2096	2876	spoolsv.exe	48
PID 2700 set thread context of 1764	2700	spoolsv.exe	52
PID 2212 set thread context of 2656	2212	spoolsv.exe	56
PID 1772 set thread context of 1136	1772	spoolsv.exe	60
PID 2044 set thread context of 540	2044	spoolsv.exe	63
PID 1708 set thread context of 900	1708	spoolsv.exe	67
PID 2308 set thread context of 2952	2308	spoolsv.exe	70
PID 2756 set thread context of 1756	2756	spoolsv.exe	74
PID 3012 set thread context of 2864	3012	spoolsv.exe	78
PID 1276 set thread context of 1480	1276	spoolsv.exe	81
PID 2912 set thread context of 1924	2912	spoolsv.exe	85
PID 288 set thread context of 1172	288	spoolsv.exe	89
PID 1960 set thread context of 2384	1960	spoolsv.exe	93
PID 2696 set thread context of 2868	2696	spoolsv.exe	97
PID 624 set thread context of 1792	624	spoolsv.exe	101
PID 1228 set thread context of 2320	1228	spoolsv.exe	105
PID 680 set thread context of 1672	680	spoolsv.exe	109
PID 1780 set thread context of 936	1780	spoolsv.exe	113
PID 2380 set thread context of 696	2380	spoolsv.exe	117
PID 2896 set thread context of 2832	2896	spoolsv.exe	121
PID 644 set thread context of 2396	644	spoolsv.exe	125
PID 1668 set thread context of 1744	1668	spoolsv.exe	129
PID 768 set thread context of 1440	768	spoolsv.exe	133
PID 1348 set thread context of 1780	1348	spoolsv.exe	137
PID 1968 set thread context of 2484	1968	spoolsv.exe	141
PID 2824 set thread context of 3036	2824	spoolsv.exe	145
PID 2068 set thread context of 2628	2068	spoolsv.exe	149
PID 2852 set thread context of 1972	2852	spoolsv.exe	153
PID 2528 set thread context of 1044	2528	spoolsv.exe	157
PID 700 set thread context of 1540	700	spoolsv.exe	161
PID 2600 set thread context of 2720	2600	spoolsv.exe	165
PID 2624 set thread context of 2148	2624	spoolsv.exe	169
PID 944 set thread context of 1280	944	spoolsv.exe	172
PID 944 set thread context of 2116	944	spoolsv.exe	173
PID 2076 set thread context of 1760	2076	spoolsv.exe	176
PID 2096 set thread context of 2224	2096	spoolsv.exe	181
PID 2400 set thread context of 2860	2400	explorer.exe	178
PID 1764 set thread context of 2880	1764	spoolsv.exe	183
PID 2660 set thread context of 2404	2660	spoolsv.exe	182
PID 2096 set thread context of 2768	2096	spoolsv.exe	186
PID 1764 set thread context of 2824	1764	spoolsv.exe	185
PID 2656 set thread context of 2008	2656	spoolsv.exe	187
PID 2656 set thread context of 2796	2656	spoolsv.exe	188
PID 1136 set thread context of 2140	1136	spoolsv.exe	196
PID 1392 set thread context of 2576	1392	explorer.exe	195
PID 1136 set thread context of 1736	1136	spoolsv.exe	197
PID 1928 set thread context of 1996	1928	spoolsv.exe	194
PID 540 set thread context of 404	540	spoolsv.exe	202
PID 540 set thread context of 1940	540	spoolsv.exe	203
PID 2908 set thread context of 2324	2908	spoolsv.exe	201
PID 900 set thread context of 3008	900	spoolsv.exe	210
PID 900 set thread context of 2012	900	spoolsv.exe	211
PID 2044 set thread context of 2460	2044	explorer.exe	212
PID 928 set thread context of 1816	928	spoolsv.exe	213
PID 2952 set thread context of 920	2952	spoolsv.exe	216
PID 2952 set thread context of 2304	2952	spoolsv.exe	218
PID 1232 set thread context of 1800	1232	spoolsv.exe	219

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3036-41-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/files/0x0008000000015c0d-87.dat	upx
behavioral1/memory/2112-96-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2112-140-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/files/0x0008000000015694-168.dat	upx
behavioral1/files/0x00090000000156b5-184.dat	upx
behavioral1/memory/2876-248-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/656-236-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2700-302-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2212-355-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1772-411-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2044-466-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1708-528-0x00000000003B0000-0x00000000003F6000-memory.dmp	upx
behavioral1/memory/2308-576-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1708-565-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2756-631-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3012-685-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1276-753-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
2112	explorer.exe
656	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2876	spoolsv.exe
2180	explorer.exe
2700	spoolsv.exe
2180	explorer.exe
2212	spoolsv.exe
2180	explorer.exe
1772	spoolsv.exe
2180	explorer.exe
2044	spoolsv.exe
2180	explorer.exe
1708	spoolsv.exe
2180	explorer.exe
2308	spoolsv.exe
2180	explorer.exe
2756	spoolsv.exe
2180	explorer.exe
3012	spoolsv.exe
2180	explorer.exe
1276	spoolsv.exe
2180	explorer.exe
2912	spoolsv.exe
2180	explorer.exe
288	spoolsv.exe
2180	explorer.exe
1960	spoolsv.exe
2180	explorer.exe
2696	spoolsv.exe
2180	explorer.exe
624	spoolsv.exe
2180	explorer.exe
1228	spoolsv.exe
2180	explorer.exe
680	spoolsv.exe
2180	explorer.exe
1780	spoolsv.exe
2180	explorer.exe
2380	spoolsv.exe
2180	explorer.exe
2896	spoolsv.exe
2180	explorer.exe
644	spoolsv.exe
2180	explorer.exe
1668	spoolsv.exe
2180	explorer.exe
768	spoolsv.exe
2180	explorer.exe
1348	spoolsv.exe
2180	explorer.exe
1968	spoolsv.exe
2180	explorer.exe
2824	spoolsv.exe
2180	explorer.exe
2068	spoolsv.exe
2180	explorer.exe
2852	spoolsv.exe
2180	explorer.exe
2528	spoolsv.exe
2180	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
2112	explorer.exe
2112	explorer.exe
2180	explorer.exe
2180	explorer.exe
656	spoolsv.exe
656	spoolsv.exe
2180	explorer.exe
2180	explorer.exe
2876	spoolsv.exe
2876	spoolsv.exe
2700	spoolsv.exe
2700	spoolsv.exe
2212	spoolsv.exe
2212	spoolsv.exe
1772	spoolsv.exe
1772	spoolsv.exe
2044	spoolsv.exe
2044	spoolsv.exe
1708	spoolsv.exe
1708	spoolsv.exe
2308	spoolsv.exe
2308	spoolsv.exe
2756	spoolsv.exe
2756	spoolsv.exe
3012	spoolsv.exe
3012	spoolsv.exe
1276	spoolsv.exe
1276	spoolsv.exe
2912	spoolsv.exe
2912	spoolsv.exe
288	spoolsv.exe
288	spoolsv.exe
1960	spoolsv.exe
1960	spoolsv.exe
2696	spoolsv.exe
2696	spoolsv.exe
624	spoolsv.exe
624	spoolsv.exe
1228	spoolsv.exe
1228	spoolsv.exe
680	spoolsv.exe
680	spoolsv.exe
1780	spoolsv.exe
1780	spoolsv.exe
2380	spoolsv.exe
2380	spoolsv.exe
2896	spoolsv.exe
2896	spoolsv.exe
644	spoolsv.exe
644	spoolsv.exe
1668	spoolsv.exe
1668	spoolsv.exe
768	spoolsv.exe
768	spoolsv.exe
1348	spoolsv.exe
1348	spoolsv.exe
1968	spoolsv.exe
1968	spoolsv.exe
2824	spoolsv.exe
2824	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 860	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	30
PID 3036 wrote to memory of 860	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	30
PID 3036 wrote to memory of 860	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	30
PID 3036 wrote to memory of 860	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	30
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 3036 wrote to memory of 2436	3036	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	32
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2956	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	34
PID 2436 wrote to memory of 2192	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	35
PID 2436 wrote to memory of 2192	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	35
PID 2436 wrote to memory of 2192	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	35
PID 2436 wrote to memory of 2192	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	35
PID 2436 wrote to memory of 2192	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	35
PID 2436 wrote to memory of 2192	2436	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	35
PID 2956 wrote to memory of 2112	2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	36
PID 2956 wrote to memory of 2112	2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	36
PID 2956 wrote to memory of 2112	2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	36
PID 2956 wrote to memory of 2112	2956	c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe	36
PID 2112 wrote to memory of 1972	2112	explorer.exe	37
PID 2112 wrote to memory of 1972	2112	explorer.exe	37
PID 2112 wrote to memory of 1972	2112	explorer.exe	37
PID 2112 wrote to memory of 1972	2112	explorer.exe	37
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39
PID 2112 wrote to memory of 840	2112	explorer.exe	39

C:\Users\Admin\AppData\Local\Temp\c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
"C:\Users\Admin\AppData\Local\Temp\c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:860
- C:\Users\Admin\AppData\Local\Temp\c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
  C:\Users\Admin\AppData\Local\Temp\c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Local\Temp\c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
    C:\Users\Admin\AppData\Local\Temp\c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:1972
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:840
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1300
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:944
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1280
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        
        PID:2188
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2116
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1620
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2768
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2756
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2824
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1748
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2796
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2648
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1736
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1288
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:540
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:404
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1940
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:744
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:900
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2012
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2888
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        
        PID:1192
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2304
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2168
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2196
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2864
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2068
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1808
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2660
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1172
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2248
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2384
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2768
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1392
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1792
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1596
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2224
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:936
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:696
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2792
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2832
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2616
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1856
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1744
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1732
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1440
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:700
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1780
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2876
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2776
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3036
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1864
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2172
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1972
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1504
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1348
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1540
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2764
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2720
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2148
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1820
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1760
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1704
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2404
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:3004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1996
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:848
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2372
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1816
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1120
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2480
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2224
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1632
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
8221efe81c93c9b232d597add4e11d61

SHA1
46b631a99272293f029f41323959ab29d1317b76

SHA256
c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd

SHA512
ea3dea30a683c3ba669c3a4dceaede8229781ad84cebc254205ecc21469a2b0defd9be8a769debd05ca04bdb39955e5b3d01cfc81c98a37e22ccd4b6d0e409c4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
4a01d507aad61cfe2013726c5d92f955

SHA1
26920341dafb4c57f1f663ae0911df9454788205

SHA256
d1ffc1a0e35cc1b83783ee11f5404c132194463cce7d59eb9eb370330ca20f76

SHA512
cef65bef50a9bbd864eb3b63deb4e92f07298ab1bc7f16b8c1d6dfaf5fa6879bdd9ff1531e379e50eacf520bd9fcd2b97abb71c740f26f598430b0acc8ee0e3e

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
5975bda0651570c32311413131d5f9ff

SHA1
0fad5a32429e2848de2ab33af9373f3ef8b3b9de

SHA256
b09b9935ad8749f9f4d0c43ae7df0a01fb8798da58f26db170c6ba68c831e92d

SHA512
dd4f0e47b4248de03c1b6ebbc9f6db1f42562ceabbe4dd9b9a50bbd0d160192318538f5d89c0144cc78612e77fd9ba849e101790f8a6449ac5f4818172e38f40

Download Submit
memory/540-2256-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/540-515-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/656-236-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/840-143-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/840-178-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/900-569-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/900-2285-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/944-244-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/944-1848-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1136-2158-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1136-465-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1276-753-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1708-565-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1708-528-0x00000000003B0000-0x00000000003F6000-memory.dmp

Filesize
280KB

Download
memory/1756-678-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1764-2056-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1764-351-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1772-419-0x0000000000550000-0x0000000000596000-memory.dmp

Filesize
280KB

Download
memory/1772-411-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2044-466-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2096-301-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2096-2055-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2112-96-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2112-140-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2180-735-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-190-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-509-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-416-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-417-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-1112-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-409-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-410-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-299-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-1013-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-1012-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-522-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-322-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-829-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-733-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-575-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-464-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-629-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-684-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-683-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-300-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2180-734-0x0000000002C80000-0x0000000002CC6000-memory.dmp

Filesize
280KB

Download
memory/2192-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2192-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2192-80-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2212-355-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2212-381-0x0000000000450000-0x0000000000496000-memory.dmp

Filesize
280KB

Download
memory/2308-576-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2308-596-0x0000000001D10000-0x0000000001D56000-memory.dmp

Filesize
280KB

Download
memory/2436-19-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-23-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-46-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2436-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-43-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2436-40-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2436-2-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2436-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-82-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2436-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2436-15-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-47-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-45-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-13-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-10-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-17-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-11-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-21-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-48-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2436-25-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-27-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-29-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-31-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-35-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2436-8-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-49-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2436-5-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2436-42-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2656-2053-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2656-405-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2700-302-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2700-325-0x00000000023F0000-0x0000000002436000-memory.dmp

Filesize
280KB

Download
memory/2756-631-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2864-751-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2876-269-0x00000000003B0000-0x00000000003F6000-memory.dmp

Filesize
280KB

Download
memory/2876-248-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2952-630-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2952-2406-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2956-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-94-0x0000000002650000-0x0000000002696000-memory.dmp

Filesize
280KB

Download
memory/2956-148-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3012-685-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3036-41-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3036-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download