Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2025, 03:00 UTC

General

  • Target

    7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe

  • Size

    2.9MB

  • MD5

    abca69ed9e3569bd5e7653f8c78973a6

  • SHA1

    30cb0487efdf25b48880d48bcc39f1f24fcd7669

  • SHA256

    7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712

  • SHA512

    a0531656f3bec001d4374ed9b7845c6439cd066db23694215152ff6e261d4249d2c9910e0dcb53dcbb397d9286e2d6b1af9ef39beaa2e475379f4bff4f4ba216

  • SSDEEP

    24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHO:7v97AXmw4gxeOw46fUbNecCCFbNec9

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops startup file 27 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
  • Suspicious use of SetThreadContext 64 IoCs
  • Drops file in Windows directory 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe
    "C:\Users\Admin\AppData\Local\Temp\7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
      2⤵
      • Drops startup file
      PID:2908
    • C:\Users\Admin\AppData\Local\Temp\7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe
      C:\Users\Admin\AppData\Local\Temp\7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Users\Admin\AppData\Local\Temp\7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe
        C:\Users\Admin\AppData\Local\Temp\7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712.exe
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1856
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
            5⤵
            • Drops startup file
            • System Location Discovery: System Language Discovery
            PID:2024
          • \??\c:\windows\system\explorer.exe
            c:\windows\system\explorer.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            PID:2324
            • \??\c:\windows\system\explorer.exe
              c:\windows\system\explorer.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visiblity of hidden/system files in Explorer
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:848
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:1104
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                  8⤵
                  • Drops startup file
                  PID:3044
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  PID:1040
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    9⤵
                      PID:764
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        10⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:1952
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                          11⤵
                          • Drops startup file
                          PID:1700
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:2476
                    • C:\Windows\SysWOW64\diskperf.exe
                      "C:\Windows\SysWOW64\diskperf.exe"
                      9⤵
                        PID:1572
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:1984
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                        PID:2496
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe
                        8⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:2004
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe
                          9⤵
                            PID:2996
                          • C:\Windows\SysWOW64\diskperf.exe
                            "C:\Windows\SysWOW64\diskperf.exe"
                            9⤵
                              PID:2496
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          7⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of SetWindowsHookEx
                          PID:2468
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                            8⤵
                              PID:2428
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe
                              8⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:2560
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:992
                              • C:\Windows\SysWOW64\diskperf.exe
                                "C:\Windows\SysWOW64\diskperf.exe"
                                9⤵
                                  PID:1480
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              7⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:2916
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                8⤵
                                  PID:776
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe
                                  8⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Suspicious use of SetThreadContext
                                  PID:1808
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe
                                    9⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1108
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      10⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:2368
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                        11⤵
                                        • Drops startup file
                                        PID:1192
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        11⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2328
                                  • C:\Windows\SysWOW64\diskperf.exe
                                    "C:\Windows\SysWOW64\diskperf.exe"
                                    9⤵
                                      PID:2520
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  7⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2184
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                    8⤵
                                    • Drops startup file
                                    PID:2332
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe
                                    8⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:2720
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2640
                                    • C:\Windows\SysWOW64\diskperf.exe
                                      "C:\Windows\SysWOW64\diskperf.exe"
                                      9⤵
                                        PID:1664
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1648
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                      8⤵
                                        PID:3028
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe
                                        8⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        PID:1684
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe
                                          9⤵
                                            PID:2564
                                          • C:\Windows\SysWOW64\diskperf.exe
                                            "C:\Windows\SysWOW64\diskperf.exe"
                                            9⤵
                                              PID:3068
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2368
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                            8⤵
                                            • Drops startup file
                                            • System Location Discovery: System Language Discovery
                                            PID:1744
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe
                                            8⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Suspicious use of SetThreadContext
                                            PID:820
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe
                                              9⤵
                                                PID:1964
                                              • C:\Windows\SysWOW64\diskperf.exe
                                                "C:\Windows\SysWOW64\diskperf.exe"
                                                9⤵
                                                  PID:1848
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              7⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2088
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                8⤵
                                                • Drops startup file
                                                PID:2952
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Suspicious use of SetThreadContext
                                                PID:2828
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe
                                                  9⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2908
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    10⤵
                                                    • Drops file in Windows directory
                                                    PID:1752
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                      11⤵
                                                      • Drops startup file
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2864
                                                    • \??\c:\windows\system\explorer.exe
                                                      c:\windows\system\explorer.exe
                                                      11⤵
                                                        PID:1288
                                                  • C:\Windows\SysWOW64\diskperf.exe
                                                    "C:\Windows\SysWOW64\diskperf.exe"
                                                    9⤵
                                                      PID:1868
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2572
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                    8⤵
                                                      PID:2648
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe
                                                      8⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Suspicious use of SetThreadContext
                                                      PID:2436
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe
                                                        9⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1700
                                                      • C:\Windows\SysWOW64\diskperf.exe
                                                        "C:\Windows\SysWOW64\diskperf.exe"
                                                        9⤵
                                                          PID:1728
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of SetThreadContext
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2540
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                        8⤵
                                                          PID:1728
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          PID:2412
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe
                                                            9⤵
                                                              PID:264
                                                            • C:\Windows\SysWOW64\diskperf.exe
                                                              "C:\Windows\SysWOW64\diskperf.exe"
                                                              9⤵
                                                                PID:2224
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of SetThreadContext
                                                            • Drops file in Windows directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1160
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                              8⤵
                                                              • Drops startup file
                                                              PID:2188
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe
                                                              8⤵
                                                              • Executes dropped EXE
                                                              • Adds Run key to start application
                                                              PID:2148
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe
                                                                9⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1132
                                                                • \??\c:\windows\system\explorer.exe
                                                                  c:\windows\system\explorer.exe
                                                                  10⤵
                                                                  • Drops file in Windows directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2112
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                    11⤵
                                                                    • Drops startup file
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2516
                                                                  • \??\c:\windows\system\explorer.exe
                                                                    c:\windows\system\explorer.exe
                                                                    11⤵
                                                                      PID:532
                                                                • C:\Windows\SysWOW64\diskperf.exe
                                                                  "C:\Windows\SysWOW64\diskperf.exe"
                                                                  9⤵
                                                                    PID:2764
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious use of SetThreadContext
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:808
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                  8⤵
                                                                    PID:304
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2880
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe
                                                                      9⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2864
                                                                    • C:\Windows\SysWOW64\diskperf.exe
                                                                      "C:\Windows\SysWOW64\diskperf.exe"
                                                                      9⤵
                                                                        PID:2788
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of SetThreadContext
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2400
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                      8⤵
                                                                        PID:1256
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        PID:404
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of SetThreadContext
                                                                      • Drops file in Windows directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2992
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                        8⤵
                                                                          PID:2520
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe
                                                                          8⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3044
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        7⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of SetThreadContext
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1544
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                          8⤵
                                                                            PID:1304
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe
                                                                            8⤵
                                                                            • Executes dropped EXE
                                                                            PID:1576
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of SetThreadContext
                                                                          • Drops file in Windows directory
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:576
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                            8⤵
                                                                              PID:2892
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2616
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious use of SetThreadContext
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2340
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                              8⤵
                                                                              • Drops startup file
                                                                              PID:1804
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1044
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious use of SetThreadContext
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2372
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                              8⤵
                                                                                PID:1932
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe
                                                                                8⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2980
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of SetThreadContext
                                                                              • Drops file in Windows directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1108
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                8⤵
                                                                                • Drops startup file
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2296
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe
                                                                                8⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1924
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of SetThreadContext
                                                                              • Drops file in Windows directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2860
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                8⤵
                                                                                  PID:844
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe
                                                                                  8⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1536
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                • Drops file in Windows directory
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2504
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                  8⤵
                                                                                    PID:2996
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe
                                                                                    8⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1980
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  7⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Drops file in Windows directory
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2676
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                    8⤵
                                                                                    • Drops startup file
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2636
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe
                                                                                    8⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2824
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  7⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Drops file in Windows directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1964
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                    8⤵
                                                                                      PID:1616
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2204
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1800
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      PID:1760
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:324
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2136
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1396
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1948
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1952
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      PID:1752
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:704
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2092
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2500
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1712
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2468
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2652
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2428
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2176
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      PID:1620
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1592
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:1036
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      PID:2336
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2188
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    PID:3020
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                      8⤵
                                                                                      • Drops startup file
                                                                                      PID:2104
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe
                                                                                      8⤵
                                                                                        PID:304
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      7⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Drops file in Windows directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1872
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                        8⤵
                                                                                        • Drops startup file
                                                                                        PID:2688
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe
                                                                                        8⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2000
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      7⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Drops file in Windows directory
                                                                                      PID:2956
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                        8⤵
                                                                                        • Drops startup file
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2172
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe
                                                                                        8⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2424
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      7⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Drops file in Windows directory
                                                                                      PID:2832
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                        8⤵
                                                                                          PID:2164
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe
                                                                                          8⤵
                                                                                            PID:892
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          7⤵
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Drops file in Windows directory
                                                                                          PID:2348
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                            8⤵
                                                                                              PID:308
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe
                                                                                              8⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2940
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            7⤵
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1872
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                              8⤵
                                                                                              • Drops startup file
                                                                                              PID:1564
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe
                                                                                              8⤵
                                                                                                PID:2480
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              PID:2608
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                  PID:2664
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe
                                                                                                  8⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2076
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                7⤵
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Drops file in Windows directory
                                                                                                PID:2900
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                  8⤵
                                                                                                    PID:1152
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe
                                                                                                    8⤵
                                                                                                      PID:1312
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    7⤵
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:2812
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                      8⤵
                                                                                                      • Drops startup file
                                                                                                      PID:2408
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe
                                                                                                      8⤵
                                                                                                        PID:2648
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      7⤵
                                                                                                      • Drops file in Windows directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1932
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                        8⤵
                                                                                                          PID:2120
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe
                                                                                                          8⤵
                                                                                                            PID:2832
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          7⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:288
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                            8⤵
                                                                                                              PID:1984
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe
                                                                                                              8⤵
                                                                                                                PID:920
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              7⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:1740
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                                8⤵
                                                                                                                • Drops startup file
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2408
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe
                                                                                                                8⤵
                                                                                                                  PID:1396
                                                                                                            • C:\Windows\SysWOW64\diskperf.exe
                                                                                                              "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                              6⤵
                                                                                                                PID:2740
                                                                                                        • C:\Windows\SysWOW64\diskperf.exe
                                                                                                          "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                          3⤵
                                                                                                            PID:1012

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

                                                                                                        Filesize

                                                                                                        2.9MB

                                                                                                        MD5

                                                                                                        abca69ed9e3569bd5e7653f8c78973a6

                                                                                                        SHA1

                                                                                                        30cb0487efdf25b48880d48bcc39f1f24fcd7669

                                                                                                        SHA256

                                                                                                        7a19623df13a0504836a8e3602b401003fd4d84176464b0c61b0e00facad0712

                                                                                                        SHA512

                                                                                                        a0531656f3bec001d4374ed9b7845c6439cd066db23694215152ff6e261d4249d2c9910e0dcb53dcbb397d9286e2d6b1af9ef39beaa2e475379f4bff4f4ba216

                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

                                                                                                        Filesize

                                                                                                        92B

                                                                                                        MD5

                                                                                                        13222a4bb413aaa8b92aa5b4f81d2760

                                                                                                        SHA1

                                                                                                        268a48f2fe84ed49bbdc1873a8009db8c7cba66a

                                                                                                        SHA256

                                                                                                        d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

                                                                                                        SHA512

                                                                                                        eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

                                                                                                        Filesize

                                                                                                        93B

                                                                                                        MD5

                                                                                                        8445bfa5a278e2f068300c604a78394b

                                                                                                        SHA1

                                                                                                        9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

                                                                                                        SHA256

                                                                                                        5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

                                                                                                        SHA512

                                                                                                        8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

                                                                                                      • \Windows\system\explorer.exe

                                                                                                        Filesize

                                                                                                        2.9MB

                                                                                                        MD5

                                                                                                        01867ee4a8a1b12c068ad4f5ac779abd

                                                                                                        SHA1

                                                                                                        e3bbbb3377f21abbee78adf7c94e5afe2de386a5

                                                                                                        SHA256

                                                                                                        8225ab81768bc8f772f967dc533d604b5f198b7551e6d9f82d2e072a2096ce35

                                                                                                        SHA512

                                                                                                        df7252a666b5ba5a6100ab72b1e86f190b8646fcacd7dee701c82e6353ef3430bd73e7012e8aa4e30625e3fd9acf2eb5908b81a0b2c44a8ecec7672be2bc5801

                                                                                                      • \Windows\system\spoolsv.exe

                                                                                                        Filesize

                                                                                                        2.9MB

                                                                                                        MD5

                                                                                                        7516e651f6fd44240f0f4508c50dd8b9

                                                                                                        SHA1

                                                                                                        404e9bf723f53c97c5bc3716c21aee33ba3b2a42

                                                                                                        SHA256

                                                                                                        98036e3991b0b0d73e5cbfe61055e142a77dd0318f641018be8103921dd72171

                                                                                                        SHA512

                                                                                                        004faaef82a2d17359b9854157abe2c49a29e455671f20297b37bb5f8a569b374e4928b986f9fd20ec91bb04f10794332240a4f715cd819bf02621b37462c6b7

                                                                                                      • memory/324-1359-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/404-837-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/704-1459-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/820-2281-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/820-543-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1012-85-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                        Filesize

                                                                                                        72KB

                                                                                                      • memory/1012-72-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                        Filesize

                                                                                                        72KB

                                                                                                      • memory/1040-1775-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1040-237-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1044-1025-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1536-1166-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1576-929-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1684-493-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1684-2216-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1808-2042-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1808-391-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1856-70-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                        Filesize

                                                                                                        248KB

                                                                                                      • memory/1856-142-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                        Filesize

                                                                                                        248KB

                                                                                                      • memory/1856-55-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                        Filesize

                                                                                                        248KB

                                                                                                      • memory/1856-57-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                        Filesize

                                                                                                        248KB

                                                                                                      • memory/1856-63-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                        Filesize

                                                                                                        248KB

                                                                                                      • memory/1856-59-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                        Filesize

                                                                                                        248KB

                                                                                                      • memory/1924-1119-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1948-1409-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/1980-1213-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2004-1804-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2148-2603-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2148-745-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2204-1311-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2324-178-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2324-138-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2412-2560-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2412-698-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2436-2444-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2436-651-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2560-341-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                        Filesize

                                                                                                        21.6MB

                                                                                                      • memory/2560-2013-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                        Filesize

                                                                                                        21.6MB

                                                                                                      • memory/2616-976-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2720-443-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2720-2177-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2824-1263-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2828-2336-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2828-599-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2880-791-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2980-1072-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-22-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-46-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-47-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-26-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-4-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-6-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-8-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-20-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-10-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-34-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-12-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-1-0x0000000000300000-0x0000000000400000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2984-14-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-80-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-16-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-2-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-44-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-18-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2984-29-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-31-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-40-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-41-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-42-0x00000000004E7000-0x0000000000513000-memory.dmp

                                                                                                        Filesize

                                                                                                        176KB

                                                                                                      • memory/2984-43-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-24-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-51-0x00000000004E7000-0x0000000000513000-memory.dmp

                                                                                                        Filesize

                                                                                                        176KB

                                                                                                      • memory/2984-45-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-49-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-50-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      • memory/2984-48-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/2984-37-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                        Filesize

                                                                                                        16.0MB

                                                                                                      • memory/3044-883-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.2MB

                                                                                                      We care about your privacy.

                                                                                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.