sality | ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc

Analysis

max time kernel
31s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Size

147KB
MD5

75c865f1747b242051eb6a05e91f915a
SHA1

624e32dc35c81331bee657174ba5744ab262564b
SHA256

ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc
SHA512

b5ca5b998a12cede7c11cac166d6f839c3ba4cbd7a22b6cdfb0385cb42ebd2e94c163543d826419f05f4cd4780e3f72003ae20d69b6ac7bebe4afadf48926cea
SSDEEP

3072:YA/yzn2EpnbZdb1U4FwhKNUrvHc9c7AWTTYbDU:YJnjbyKUziXMTN

Score

10^/10

sality backdoor discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	USBInfo.com

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	USBInfo.com

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBStor.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\Driver.sys	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.sy_	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBSys.vbe	cmd.exe

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3568	attrib.exe
2736	attrib.exe
2152	attrib.exe
3380	attrib.exe
3192	attrib.exe
4224	attrib.exe
3992	attrib.exe
3868	attrib.exe
1624	attrib.exe
4224	attrib.exe
3612	attrib.exe
116	attrib.exe
4656	attrib.exe
3548	attrib.exe
3876	attrib.exe
4476	attrib.exe
2532	attrib.exe
1556	attrib.exe
1232	attrib.exe
1936	attrib.exe
2748	attrib.exe
3076	attrib.exe
1400	attrib.exe
2348	attrib.exe
3016	attrib.exe
3580	attrib.exe
4448	attrib.exe
4144	attrib.exe
3236	attrib.exe
448	attrib.exe
4552	attrib.exe
2260	attrib.exe
2700	attrib.exe
1072	attrib.exe
660	attrib.exe
5084	attrib.exe
4544	attrib.exe
3044	attrib.exe
4076	attrib.exe
3656	attrib.exe
2268	attrib.exe
620	attrib.exe
3704	attrib.exe
2660	attrib.exe
2200	attrib.exe
3880	attrib.exe
460	attrib.exe
1468	attrib.exe
5092	attrib.exe
2464	attrib.exe
836	attrib.exe
3356	attrib.exe
1868	attrib.exe
3604	attrib.exe
1680	attrib.exe
4444	attrib.exe
4036	attrib.exe
3152	attrib.exe
2340	attrib.exe
1724	attrib.exe
1472	attrib.exe
1172	attrib.exe
4912	attrib.exe
2332	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe

Deletes itself 1 IoCs

pid	Process
3696	USBInfo.com

Executes dropped EXE 1 IoCs

pid	Process
3696	USBInfo.com

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	USBInfo.com
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\\desktop.ini	cmd.exe
File created	F:\\desktop.ini	cmd.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
File opened (read-only)	\??\E:	USBInfo.com
File opened (read-only)	\??\G:	USBInfo.com
File opened (read-only)	\??\H:	USBInfo.com

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	attrib.exe
File created	F:\\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	attrib.exe
File created	C:\\autorun.inf	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4816-8-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-5-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-13-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-14-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-15-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-17-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-19-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-7-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-6-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-31-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-30-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-32-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-33-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/4816-34-0x00000000022F0000-0x000000000337E000-memory.dmp	upx
behavioral2/memory/3696-121-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-129-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-130-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-128-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-125-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-124-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-123-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-127-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-126-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-140-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-141-0x0000000002350000-0x00000000033DE000-memory.dmp	upx
behavioral2/memory/3696-142-0x0000000002350000-0x00000000033DE000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBInfo.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
4476	taskkill.exe
1400	taskkill.exe
2764	taskkill.exe
3908	taskkill.exe
2012	taskkill.exe
2776	taskkill.exe
2716	taskkill.exe
4352	taskkill.exe
4856	taskkill.exe
3872	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe

Runs regedit.exe 10 IoCs

pid	Process
2260	regedit.exe
216	regedit.exe
4496	regedit.exe
2372	regedit.exe
996	regedit.exe
872	regedit.exe
5076	regedit.exe
872	regedit.exe
3992	regedit.exe
4928	regedit.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
3696	USBInfo.com
3696	USBInfo.com
3696	USBInfo.com
3696	USBInfo.com

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4884	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	82
PID 4816 wrote to memory of 4884	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	82
PID 4816 wrote to memory of 4884	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	82
PID 4816 wrote to memory of 792	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	9
PID 4816 wrote to memory of 800	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	10
PID 4816 wrote to memory of 336	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	13
PID 4816 wrote to memory of 2244	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	51
PID 4816 wrote to memory of 2640	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	52
PID 4816 wrote to memory of 2664	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	53
PID 4816 wrote to memory of 3424	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	56
PID 4816 wrote to memory of 3540	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	57
PID 4816 wrote to memory of 3732	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	58
PID 4816 wrote to memory of 3824	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	59
PID 4816 wrote to memory of 3892	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	60
PID 4816 wrote to memory of 3976	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	61
PID 4816 wrote to memory of 3436	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	62
PID 4816 wrote to memory of 2872	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	75
PID 4816 wrote to memory of 552	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	76
PID 4816 wrote to memory of 4884	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	82
PID 4816 wrote to memory of 4884	4816	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	82
PID 4884 wrote to memory of 224	4884	cmd.exe	84
PID 4884 wrote to memory of 224	4884	cmd.exe	84
PID 4884 wrote to memory of 224	4884	cmd.exe	84
PID 4884 wrote to memory of 664	4884	cmd.exe	85
PID 4884 wrote to memory of 664	4884	cmd.exe	85
PID 4884 wrote to memory of 664	4884	cmd.exe	85
PID 4884 wrote to memory of 1272	4884	cmd.exe	86
PID 4884 wrote to memory of 1272	4884	cmd.exe	86
PID 4884 wrote to memory of 1272	4884	cmd.exe	86
PID 1272 wrote to memory of 3696	1272	WScript.exe	87
PID 1272 wrote to memory of 3696	1272	WScript.exe	87
PID 1272 wrote to memory of 3696	1272	WScript.exe	87
PID 3696 wrote to memory of 3368	3696	USBInfo.com	88
PID 3696 wrote to memory of 3368	3696	USBInfo.com	88
PID 3696 wrote to memory of 3368	3696	USBInfo.com	88
PID 3368 wrote to memory of 2764	3368	cmd.exe	90
PID 3368 wrote to memory of 2764	3368	cmd.exe	90
PID 3368 wrote to memory of 2764	3368	cmd.exe	90
PID 3368 wrote to memory of 216	3368	cmd.exe	92
PID 3368 wrote to memory of 216	3368	cmd.exe	92
PID 3368 wrote to memory of 216	3368	cmd.exe	92
PID 3368 wrote to memory of 2848	3368	cmd.exe	93
PID 3368 wrote to memory of 2848	3368	cmd.exe	93
PID 3368 wrote to memory of 2848	3368	cmd.exe	93
PID 3368 wrote to memory of 736	3368	cmd.exe	94
PID 3368 wrote to memory of 736	3368	cmd.exe	94
PID 3368 wrote to memory of 736	3368	cmd.exe	94
PID 3368 wrote to memory of 620	3368	cmd.exe	95
PID 3368 wrote to memory of 620	3368	cmd.exe	95
PID 3368 wrote to memory of 620	3368	cmd.exe	95
PID 3368 wrote to memory of 2260	3368	cmd.exe	96
PID 3368 wrote to memory of 2260	3368	cmd.exe	96
PID 3368 wrote to memory of 2260	3368	cmd.exe	96
PID 3368 wrote to memory of 3704	3368	cmd.exe	97
PID 3368 wrote to memory of 3704	3368	cmd.exe	97
PID 3368 wrote to memory of 3704	3368	cmd.exe	97
PID 3368 wrote to memory of 4224	3368	cmd.exe	98
PID 3368 wrote to memory of 4224	3368	cmd.exe	98
PID 3368 wrote to memory of 4224	3368	cmd.exe	98
PID 3368 wrote to memory of 3876	3368	cmd.exe	99
PID 3368 wrote to memory of 3876	3368	cmd.exe	99
PID 3368 wrote to memory of 3876	3368	cmd.exe	99
PID 3368 wrote to memory of 4476	3368	cmd.exe	100
PID 3368 wrote to memory of 4476	3368	cmd.exe	100

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1168	attrib.exe
2152	attrib.exe
2552	attrib.exe
3604	attrib.exe
2260	attrib.exe
1300	attrib.exe
4324	attrib.exe
2748	attrib.exe
448	attrib.exe
1180	attrib.exe
1624	attrib.exe
4288	attrib.exe
1232	attrib.exe
2340	attrib.exe
2736	attrib.exe
3548	attrib.exe
4144	attrib.exe
4788	attrib.exe
916	attrib.exe
3656	attrib.exe
408	attrib.exe
3152	attrib.exe
2464	attrib.exe
1488	attrib.exe
1680	attrib.exe
2700	attrib.exe
3612	attrib.exe
2348	attrib.exe
1072	attrib.exe
3076	attrib.exe
836	attrib.exe
1400	attrib.exe
2808	attrib.exe
2408	attrib.exe
2432	attrib.exe
224	attrib.exe
4652	attrib.exe
5092	attrib.exe
3992	attrib.exe
2200	attrib.exe
1468	attrib.exe
3236	attrib.exe
4552	attrib.exe
4912	attrib.exe
1556	attrib.exe
660	attrib.exe
3704	attrib.exe
1724	attrib.exe
1172	attrib.exe
3044	attrib.exe
1472	attrib.exe
3996	attrib.exe
660	attrib.exe
3380	attrib.exe
3192	attrib.exe
3356	attrib.exe
3396	attrib.exe
620	attrib.exe
2532	attrib.exe
4544	attrib.exe
3580	attrib.exe
2660	attrib.exe
4224	attrib.exe
1936	attrib.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2640

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2664

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
  "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~7EA6.bat "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
    3⤵
    - Drops file in Drivers directory
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:224
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:664
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBInfo.vbe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\Drivers\USBInfo.com
        
        "C:\Windows\system32\Drivers\USBInfo.com"
        5⤵
        Modifies firewall policy service
        UAC bypass
        Windows security bypass
        Deletes itself
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3696
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~9D2A.bat "C:\Windows\system32\Drivers\USBInfo.com"
        6⤵
        Drops file in Drivers directory
        Checks computer location settings
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2764
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:216
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:736
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:620
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "$Recycle.Bin"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3704
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Documents and Settings"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "PerfLogs"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:3876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Program Files"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Program Files (x86)"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1300
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "ProgramData"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1724
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Recovery"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "System Volume Information"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Users"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Windows"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5092
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3992
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2532
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "$RECYCLE.BIN"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3076
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "System Volume Information"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2700
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4856
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:872
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:916
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1624
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3044
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4912
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:3908
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:4496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:3996
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2808
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3612
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        
        PID:4036
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:2660
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:4288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2348
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2408
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:2012
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:3992
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        
        PID:4656
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3656
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:1168
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:408
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1072
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2432
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3152
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:2776
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:3568
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:3016
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        
        PID:736
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2464
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3580
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1232
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:2716
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:996
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:1488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1936
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2200
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2736
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        
        PID:2332
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:2268
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:3880
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:3872
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:872
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        
        PID:956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:460
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:5084
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:4448
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3548
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2552
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:4352
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:5076
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3380
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3236
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2340
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:4476
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:4928
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1680
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:448
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3356
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4552
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2748
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:444
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:4788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:1180
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:3396
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:1400
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2260
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3540

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3732

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3824

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3892

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3976

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~7EA6.bat

Filesize
4KB

MD5
bc278224d87330dbedf84ddefdced3f1

SHA1
0a21b60897db6bd7559fef583bb095266110b653

SHA256
1d75230f2ab4daeb62d42bb1bea8a5c4c9f6831f3830407f9615677dc29dac7a

SHA512
6ff654c73c68420d97657657f77d3934aaa60fddceca095d0f9d3f169e6fab7435d3a758f0d3eae086b2ee32ea7e5c0fa3ba602bc9416e0e1e2ca8743f0d846a

Download Submit
C:\Windows\SYSTEM.INI

Filesize
257B

MD5
22100584c4bac88a9e789445cc99d9f4

SHA1
23dd9245f53f77daf7afc5aaf26ef6231c21feb7

SHA256
e7cfb21cd1378af2c50437827582fbb2665255610bc6febbb3f3e808752d8b16

SHA512
41141de46a46e4abc854bb40babc6ad9e998d02590526be637bdfaae9ae63ced501a9a72c22f96559ef12616913e350076032f5576180880a90a10cd1248ac2c

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.com

Filesize
147KB

MD5
75c865f1747b242051eb6a05e91f915a

SHA1
624e32dc35c81331bee657174ba5744ab262564b

SHA256
ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc

SHA512
b5ca5b998a12cede7c11cac166d6f839c3ba4cbd7a22b6cdfb0385cb42ebd2e94c163543d826419f05f4cd4780e3f72003ae20d69b6ac7bebe4afadf48926cea

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.vbe

Filesize
77B

MD5
54ceb8eabaff522c097e4949d39fbd09

SHA1
304fd3c274aac25477ba1f3f500ae34e6c94612d

SHA256
d2d64a938a71d1b747112176eeb345991433fc81475a397b85b6b4c3d97f8550

SHA512
3c6ce4fe30121305b176a3ccc7358343bfdd28537358e7289e4354b52f152c018acfe843659df5bd35228fca804b0285baa8350e2b6ca39719bdefdb77b2e0be

Download Submit
C:\Windows\SysWOW64\Drivers\USBStor.vbe

Filesize
20B

MD5
905d7a48a13a75ced1342bbdf0a3ace2

SHA1
3bcc021a82ed38810bcf61286eb1f4e578e3721f

SHA256
10338a72fbacb4fdf731d8937cdf23519896c5122b6a80079527cebf8406b3cd

SHA512
fe77b8b928ba1ffb1a8bf941b2a0279b3ca6512d30dd1a2e2f363f9b2be245e361fab40232bc868f0f7e79bacc476653a49b66d2cf6945ed87b0c776783db8c1

Download Submit
C:\Windows\SysWOW64\Drivers\USBSys.vbe

Filesize
19B

MD5
322866ac1312f3bc0dd8685949f35b6a

SHA1
dc3f64764aa99595ee48721142d2301ebbe07aec

SHA256
5417fd3704beb2760ed54c38048ae44d2cd49312be2a8f104e542bbd5bbc88d6

SHA512
1b5c2320beaeb34895a1d11882566463d365a128db4d260189850990e1215ce737334ee96b43ecd2c018f040548209cc6f11328a5a9b9eb5f57fc6ac61afe03d

Download Submit
C:\Windows\SysWOW64\drivers\USBInfo.sy_

Filesize
1KB

MD5
e3f32bf45469d18567e23485109ffdd4

SHA1
2e207b073a4237e05b5da89f9ca2e9771757620c

SHA256
e41ad345599c751ed8b124229df31681f2c44d322d092f85c2205b97f09c8a81

SHA512
e8ab034c883c747d6a093d1221e080adf84a1c3662e4469c59cf49f693561262d435c28eede60e18151222fd9562abc6c81b6a57fa5587032cbc2d0b74a0c0e5

Download Submit
C:\autorun.inf

Filesize
149B

MD5
babb9292822f6963475088494e446a00

SHA1
d0f96ea279562a899f24b5a6905065de029877b0

SHA256
bff5694d6d4c8a41217fa9d98d95c355a6f63ef939a4ef89bc45d1cf443a1f9d

SHA512
b96daa0a52867f7f0454c8b35d85682aa22c3ac59495760c95204cc1cfc419bd88b5cc59d92dfab5a6343f8f86659e35e2f38cda0c1ea014d2377ab5e525fd5b

Download Submit
C:\desktop.ini

Filesize
150B

MD5
ec4064ac609dc25d680be76463282759

SHA1
e811243e6946ab739afe39f79e7e010c5d3aa646

SHA256
5f7b66850209b68edce639f55db86876840969a4302143811f5953b643f45dae

SHA512
e65ad34b719c46d97729167cd0c8ed0ba8a9ee567b67a4663ddc48873735914c28315428b8415ced78a7608165910dcb4583222b08e3e1a7cabf7b3e9339401f

Download Submit
C:\vuvb.pif

Filesize
100KB

MD5
042b7217342dca9381c799cf9f6116ad

SHA1
c06a828c8a997fb83a95f7dcb5bd042ec44f4200

SHA256
894b3263bb87a51bbe94f8a87ee6c3a2908470b1a41ceb35004a653c08e49c5f

SHA512
a17ec75911faa7495cd52ec0920b67ea38264be02bdf1cc09d4f045a1b29ed0467f62df9981f018c6fb3d156ba5651df7d488ca424d27c970629a8b0d87eb320

Download Submit
F:\desktop.ini

Filesize
41B

MD5
fc58af21d2445196d228547ba36ce949

SHA1
f5eade25a4c478faa988d62ad7f93679a148e511

SHA256
93bd2fd7de32217b93b299ccf87fe53d47f5c1f1b44dbcfa3921f10d405d026e

SHA512
eabe18f6d152fd1f4450d618ed0084990f90071cc18d42812a68339d3fd55c8b4a4ce03fb575730a2188a8ce3bfb15c275ad6a00820902a3737723220fdd4427

Download Submit
memory/1344-137-0x0000000000EA0000-0x0000000000EA2000-memory.dmp

Filesize
8KB

Download
memory/1344-136-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1344-143-0x0000000000EA0000-0x0000000000EA2000-memory.dmp

Filesize
8KB

Download
memory/3368-139-0x0000000003130000-0x0000000003132000-memory.dmp

Filesize
8KB

Download
memory/3368-134-0x0000000003180000-0x0000000003181000-memory.dmp

Filesize
4KB

Download
memory/3696-124-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-128-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-125-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-138-0x00000000006C0000-0x00000000006C2000-memory.dmp

Filesize
8KB

Download
memory/3696-132-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/3696-130-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-129-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-121-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-123-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-127-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-126-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-120-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3696-140-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-141-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/3696-142-0x0000000002350000-0x00000000033DE000-memory.dmp

Filesize
16.6MB

Download
memory/4816-6-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4816-63-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4816-8-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-43-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4816-34-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-33-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-32-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-30-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-31-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-16-0x00000000006E0000-0x00000000006E2000-memory.dmp

Filesize
8KB

Download
memory/4816-10-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4816-5-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-54-0x00000000006E0000-0x00000000006E2000-memory.dmp

Filesize
8KB

Download
memory/4816-7-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-9-0x00000000006E0000-0x00000000006E2000-memory.dmp

Filesize
8KB

Download
memory/4816-13-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-19-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-17-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-18-0x00000000006E0000-0x00000000006E2000-memory.dmp

Filesize
8KB

Download
memory/4816-15-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4816-14-0x00000000022F0000-0x000000000337E000-memory.dmp

Filesize
16.6MB

Download
memory/4884-20-0x00000000007D0000-0x00000000007D2000-memory.dmp

Filesize
8KB

Download
memory/4884-22-0x00000000007D0000-0x00000000007D2000-memory.dmp

Filesize
8KB

Download
memory/4884-12-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/4884-44-0x00000000007D0000-0x00000000007D2000-memory.dmp

Filesize
8KB

Download