Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 8:44 a.m.	June 25, 2021, 8:46 a.m.

Size	272.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5	`33351949749d92f0c1fc87e7529e59d5`
SHA256	`70bbe5e2d1987ad7bf4cb067ef7c2447ef8fbc668078e725abd14d49857a8d3a`
CRC32	`D20A7E09`
ssdeep	`6144:+EtTqjFalCtjOw0B+oJTij3iQnJ+rgyQPz0zRLJauGQ2TRJPiJvT:+E9flvXCj3iKJogT0DbGQkRJPk`
Yara	Microsoft_Office_File_Zero - Microsoft Office File

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\l90t.msi
2948
explorer.exe C:\Windows\Explorer.EXE
1848
- netsh.exe "C:\Windows\SysWOW64\netsh.exe"
  2988
  - cmd.exe /c del "C:\Windows\Installer\MSI6201.tmp"
    2672

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 25, 2021, 8:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 25, 2021, 8:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 8:44 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2021, 8:44 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 8:44 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72561000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73764000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72562000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72221000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x721a1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03a60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72192000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x037b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:37 a.m.	process_identifier: 1848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000770d6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:37 a.m.	process_identifier: 1848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000770d9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:37 a.m.	process_identifier: 1848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000770d3000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 8:37 a.m.	process_identifier: 1848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000770d8000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 8:44 a.m.	process_identifier: 2988 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b60000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

explorer.exe tried to sleep 174 seconds, actually delayed analysis time by 174 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW June 25, 2021, 8:44 a.m.	total_number_of_free_bytes: 13727350784 free_bytes_available: 13727350784 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW June 25, 2021, 8:44 a.m.	number_of_free_clusters: 3351404 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW June 25, 2021, 8:38 a.m.	total_number_of_free_bytes: 13727375360 free_bytes_available: 13727375360 root_path: C:\ total_number_of_bytes: 34252779520	1	1

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 25, 2021, 8:44 a.m.	thread_identifier: 1632 thread_handle: 0x000000b8 process_identifier: 2672 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /c del "C:\Windows\Installer\MSI6201.tmp" filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000108	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (17 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 8:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	/c del "C:\Windows\Installer\MSI6201.tmp"
cmdline	C:\Windows\SysWOW64\netsh.exe

Created a process named as a common system process (48 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0
CreateProcessInternalW June 25, 2021, 8:37 a.m.	thread_identifier: 0 thread_handle: 0x0000000000000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\spoolsv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\spoolsv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000000000000000		0	0

l90t.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All