751stealer | e995ef48247c9e019d9110e09b6b3c2f8ec9a2ca4982e30a75a55ba29dfd0964

Analysis

user interaction
yes
max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zero Generator.exe
Size 1.8MB
Sample260910-tlv6nsdf85
SHA256 e995ef48247c9e019d9110e09b6b3c2f8ec9a2ca4982e30a75a55ba29dfd0964
MD5 a7743c9dcafc045c5b4ed78c3a2a634d
SHA1 957343897ceb6656516a4ade4fc0e2af931c3ceb
SHA512 7f3d1c771d1e6521c4c44945fedbcb3d925921b93d48decd8aef7f859a5ab9d5a7ce0a3aae69741d2340734b6eee09bb48197ed18237d5d84b6819a6218029c0
SSDEEP 49152:f/1ufdxsd4Y+rMZrbVtRFb9rmm+GJ0uX:Vuf3s7OM9VNNmmsuX
TLSH
T1CF95E189959000F9C5A3DB78DF7B198AF372B8839B75614733980A925F73360DE2B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

751stealer persistence stealer

Malware Config

Extracted

Family

751stealer

http://stealer.best

Attributes

owner_id
8da0e2f45f6c4e04

Signatures

Family: 751Stealer
751 Stealer is a Windows infostealer distributed as a .NET 8 single-file bundle that grabs browser data, files, and crypto wallets.
stealer 751stealer

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\VisualStudio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe

Executes dropped EXE 64 IoCs

pid	Process
5204	vcspawn.exe
4120	vcspawn.exe
5860	vcspawn.exe
5252	vcspawn.exe
1096	vcspawn.exe
5600	vcspawn.exe
2456	vcspawn.exe
1076	vcspawn.exe
5460	vcspawn.exe
4280	vcspawn.exe
1564	vcspawn.exe
3508	vcspawn.exe
5908	vcspawn.exe
1152	vcspawn.exe
2804	vcspawn.exe
4308	vcspawn.exe
2980	vcspawn.exe
3000	vcspawn.exe
2096	vcspawn.exe
4304	vcspawn.exe
2584	vcspawn.exe
2560	vcspawn.exe
2404	vcspawn.exe
4604	vcspawn.exe
5960	vcspawn.exe
4260	vcspawn.exe
4180	vcspawn.exe
1748	vcspawn.exe
1392	vcspawn.exe
1368	vcspawn.exe
1984	vcspawn.exe
4156	vcspawn.exe
3276	vcspawn.exe
5044	vcspawn.exe
4196	vcspawn.exe
2716	vcspawn.exe
4424	vcspawn.exe
3212	vcspawn.exe
4188	vcspawn.exe
2676	vcspawn.exe
4128	vcspawn.exe
200	vcspawn.exe
5568	vcspawn.exe
3152	vcspawn.exe
2168	vcspawn.exe
5916	vcspawn.exe
2656	vcspawn.exe
3252	vcspawn.exe
1884	vcspawn.exe
5396	vcspawn.exe
4660	vcspawn.exe
1084	vcspawn.exe
1792	vcspawn.exe
4656	vcspawn.exe
4840	vcspawn.exe
2692	vcspawn.exe
1824	vcspawn.exe
3124	vcspawn.exe
4444	vcspawn.exe
824	vcspawn.exe
3592	vcspawn.exe
5124	vcspawn.exe
5728	vcspawn.exe
4764	vcspawn.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe	Zero Generator.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	Zero Generator.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6348	vcspawn.exe
6348	vcspawn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 5204	3632	Zero Generator.exe	89
PID 5204 wrote to memory of 4120	5204	vcspawn.exe	90
PID 4120 wrote to memory of 5860	4120	vcspawn.exe	91
PID 5860 wrote to memory of 5252	5860	vcspawn.exe	92
PID 4120 wrote to memory of 1096	4120	vcspawn.exe	93
PID 5252 wrote to memory of 5600	5252	vcspawn.exe	94
PID 1096 wrote to memory of 2456	1096	vcspawn.exe	95
PID 5600 wrote to memory of 1076	5600	vcspawn.exe	96
PID 5252 wrote to memory of 5460	5252	vcspawn.exe	97
PID 1076 wrote to memory of 4280	1076	vcspawn.exe	98
PID 5460 wrote to memory of 1564	5460	vcspawn.exe	99
PID 4280 wrote to memory of 3508	4280	vcspawn.exe	100
PID 1076 wrote to memory of 5908	1076	vcspawn.exe	101
PID 5252 wrote to memory of 1152	5252	vcspawn.exe	102
PID 3508 wrote to memory of 2804	3508	vcspawn.exe	103
PID 5908 wrote to memory of 4308	5908	vcspawn.exe	104
PID 1152 wrote to memory of 2980	1152	vcspawn.exe	105
PID 1564 wrote to memory of 3000	1564	vcspawn.exe	106
PID 3000 wrote to memory of 2096	3000	vcspawn.exe	107
PID 2804 wrote to memory of 4304	2804	vcspawn.exe	108
PID 3508 wrote to memory of 2584	3508	vcspawn.exe	110
PID 4304 wrote to memory of 2560	4304	vcspawn.exe	111
PID 2584 wrote to memory of 2404	2584	vcspawn.exe	112
PID 2560 wrote to memory of 4604	2560	vcspawn.exe	113
PID 5252 wrote to memory of 5960	5252	vcspawn.exe	114
PID 1076 wrote to memory of 4260	1076	vcspawn.exe	115
PID 4304 wrote to memory of 4180	4304	vcspawn.exe	116
PID 4308 wrote to memory of 1748	4308	vcspawn.exe	117
PID 5960 wrote to memory of 1392	5960	vcspawn.exe	118
PID 4604 wrote to memory of 1368	4604	vcspawn.exe	119
PID 2980 wrote to memory of 1984	2980	vcspawn.exe	120
PID 4180 wrote to memory of 4156	4180	vcspawn.exe	121
PID 4260 wrote to memory of 3276	4260	vcspawn.exe	122
PID 1984 wrote to memory of 5044	1984	vcspawn.exe	123
PID 1368 wrote to memory of 4196	1368	vcspawn.exe	124
PID 1748 wrote to memory of 2716	1748	vcspawn.exe	125
PID 3508 wrote to memory of 4424	3508	vcspawn.exe	126
PID 1564 wrote to memory of 3212	1564	vcspawn.exe	127
PID 4308 wrote to memory of 4188	4308	vcspawn.exe	128
PID 4604 wrote to memory of 2676	4604	vcspawn.exe	129
PID 2716 wrote to memory of 4128	2716	vcspawn.exe	130
PID 2404 wrote to memory of 200	2404	vcspawn.exe	131
PID 4424 wrote to memory of 5568	4424	vcspawn.exe	132
PID 2676 wrote to memory of 5916	2676	vcspawn.exe	133
PID 3212 wrote to memory of 3152	3212	vcspawn.exe	134
PID 4188 wrote to memory of 2168	4188	vcspawn.exe	135
PID 2096 wrote to memory of 2656	2096	vcspawn.exe	136
PID 4196 wrote to memory of 3252	4196	vcspawn.exe	137
PID 4128 wrote to memory of 1884	4128	vcspawn.exe	138
PID 200 wrote to memory of 5396	200	vcspawn.exe	139
PID 3252 wrote to memory of 4660	3252	vcspawn.exe	140
PID 2656 wrote to memory of 1084	2656	vcspawn.exe	141
PID 2980 wrote to memory of 1792	2980	vcspawn.exe	142
PID 2096 wrote to memory of 4656	2096	vcspawn.exe	143
PID 4304 wrote to memory of 4840	4304	vcspawn.exe	144
PID 1076 wrote to memory of 2692	1076	vcspawn.exe	145
PID 4120 wrote to memory of 1824	4120	vcspawn.exe	146
PID 1084 wrote to memory of 3124	1084	vcspawn.exe	147
PID 3276 wrote to memory of 4444	3276	vcspawn.exe	148
PID 4656 wrote to memory of 824	4656	vcspawn.exe	149
PID 1792 wrote to memory of 3592	1792	vcspawn.exe	150
PID 2456 wrote to memory of 5124	2456	vcspawn.exe	151
PID 4840 wrote to memory of 5728	4840	vcspawn.exe	152
PID 4156 wrote to memory of 4764	4156	vcspawn.exe	153

C:\Users\Admin\AppData\Local\Temp\Zero Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Zero Generator.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
  "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
    "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5204
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
      "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:5860
    - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5860
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5252
      - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5600
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5600
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4280
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 2804
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 2560
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1368
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 3252
        17⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 2676
        15⤵
        Executes dropped EXE
        
        PID:5916
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        
        PID:1072
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1072
        17⤵
        
        PID:6584
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:3232
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 3232
        15⤵
        
        PID:6356
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4180
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4764
        15⤵
        
        PID:1352
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4840
        13⤵
        Executes dropped EXE
        
        PID:5728
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 2584
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:200
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 200
        13⤵
        Executes dropped EXE
        
        PID:5396
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:2220
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 2220
        15⤵
        
        PID:6508
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:1880
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1880
        13⤵
        
        PID:2760
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4424
        11⤵
        Executes dropped EXE
        
        PID:5568
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        
        PID:6364
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6364
        13⤵
        
        PID:6616
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        
        PID:4820
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4820
        11⤵
        
        PID:6412
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5908
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5908
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1748
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4128
        13⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:6348
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6348
        15⤵
        
        PID:6608
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        Drops file in Program Files directory
        
        PID:6736
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6736
        17⤵
        
        PID:6796
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        18⤵
        Adds policy Run key to start application
        
        PID:6904
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6904
        19⤵
        
        PID:6964
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        20⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:6440
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6440
        21⤵
        
        PID:6708
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        22⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:6924
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6924
        23⤵
        
        PID:7128
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        24⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:7216
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7216
        25⤵
        
        PID:7480
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        22⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:6712
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6712
        23⤵
        
        PID:7344
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        20⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:7088
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7088
        21⤵
        
        PID:7116
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        22⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:7352
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7352
        23⤵
        
        PID:7512
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        20⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:6952
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6952
        21⤵
        
        PID:7380
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        18⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:1304
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1304
        19⤵
        
        PID:6228
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        20⤵
        Drops file in Program Files directory
        
        PID:7628
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7628
        21⤵
        
        PID:7684
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        22⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:7968
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7968
        23⤵
        
        PID:8072
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        20⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:7880
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7880
        21⤵
        
        PID:7976
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        18⤵
        Drops file in Program Files directory
        
        PID:7556
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7556
        19⤵
        
        PID:7620
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:6832
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6832
        17⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\VC\bin\vcspawn.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\VC\bin\vcspawn.exe"
        15⤵
        Drops file in Program Files directory
        
        PID:6644
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:8004
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 8004
        17⤵
        
        PID:8088
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:6676
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6676
        15⤵
        
        PID:6744
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        
        PID:7076
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7076
        17⤵
        
        PID:7136
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        18⤵
        Adds policy Run key to start application
        
        PID:6920
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6920
        19⤵
        
        PID:6724
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        20⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:6908
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6908
        21⤵
        
        PID:7396
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        18⤵
        Adds policy Run key to start application
        
        PID:6428
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6428
        19⤵
        
        PID:7256
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:4492
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4492
        17⤵
        
        PID:6860
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        18⤵
        Drops file in Program Files directory
        
        PID:7388
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7388
        19⤵
        
        PID:7520
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        20⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:7784
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7784
        21⤵
        
        PID:7844
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        18⤵
        
        PID:7716
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7716
        19⤵
        
        PID:7792
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        16⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:7208
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7208
        17⤵
        
        PID:7416
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        14⤵
        Adds policy Run key to start application
        
        PID:7008
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 7008
        15⤵
        
        PID:7092
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        
        PID:3180
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 3180
        13⤵
        
        PID:6380
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4188
        11⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Drops file in Program Files directory
        
        PID:6160
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 6160
        13⤵
        
        PID:6576
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Drops file in Program Files directory
        
        PID:3600
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 3600
        11⤵
        
        PID:6404
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4260
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4444
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4444
        11⤵
        
        PID:2060
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2692
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 2692
        9⤵
        
        PID:1972
      - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        6⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5460
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5460
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 3000
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 2656
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3124
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 3124
        13⤵
        
        PID:692
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4656
        11⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 3212
        9⤵
        Executes dropped EXE
        
        PID:3152
      - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        6⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1152
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1984
        9⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        
        PID:5532
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5532
        11⤵
        
        PID:3816
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        12⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:1976
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1976
        13⤵
        
        PID:6540
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        10⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:1796
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1796
        11⤵
        
        PID:6260
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1792
        9⤵
        Executes dropped EXE
        
        PID:3592
      - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5960
        7⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        8⤵
        
        PID:4792
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4792
        9⤵
        
        PID:6516
      - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        6⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:892
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 892
        7⤵
        
        PID:6300
  - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
      "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1096
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2456
      - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        6⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5124
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 5124
        7⤵
        
        PID:2664
  - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
      "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Drops file in Program Files directory
      PID:1824
    - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1824
        5⤵
        
        PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcspawn.exe

Path C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
Size 1.8MB
SHA256 e995ef48247c9e019d9110e09b6b3c2f8ec9a2ca4982e30a75a55ba29dfd0964
MD5 a7743c9dcafc045c5b4ed78c3a2a634d
SHA1 957343897ceb6656516a4ade4fc0e2af931c3ceb
SHA512 7f3d1c771d1e6521c4c44945fedbcb3d925921b93d48decd8aef7f859a5ab9d5a7ce0a3aae69741d2340734b6eee09bb48197ed18237d5d84b6819a6218029c0
SSDEEP 49152:f/1ufdxsd4Y+rMZrbVtRFb9rmm+GJ0uX:Vuf3s7OM9VNNmmsuX
TLSH
T1CF95E189959000F9C5A3DB78DF7B198AF372B8839B75614733980A925F73360DE2B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download