Overview

overview

10

Static

static

3

ce3ecf3836...dc.exe

windows7-x64

10

ce3ecf3836...dc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    26s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 18:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe

  • Size

    147KB

  • MD5

    75c865f1747b242051eb6a05e91f915a

  • SHA1

    624e32dc35c81331bee657174ba5744ab262564b

  • SHA256

    ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc

  • SHA512

    b5ca5b998a12cede7c11cac166d6f839c3ba4cbd7a22b6cdfb0385cb42ebd2e94c163543d826419f05f4cd4780e3f72003ae20d69b6ac7bebe4afadf48926cea

  • SSDEEP

    3072:YA/yzn2EpnbZdb1U4FwhKNUrvHc9c7AWTTYbDU:YJnjbyKUziXMTN

Score
10/10
salitybackdoordiscoveryevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 7 IoCs
  • Sets file to hidden 1 TTPs 64 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 11 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Runs regedit.exe 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:776
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:784
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:316
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2988
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3036
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:1068
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3492
                  • C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
                    "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:2368
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~9124.bat "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
                      3⤵
                      • Drops file in Drivers directory
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2044
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib -s -h "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Views/modifies file attributes
                        PID:2528
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4856
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBInfo.vbe"
                        4⤵
                        • Checks computer location settings
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5112
                        • C:\Windows\SysWOW64\Drivers\USBInfo.com
                          "C:\Windows\system32\Drivers\USBInfo.com"
                          5⤵
                          • Modifies firewall policy service
                          • UAC bypass
                          • Windows security bypass
                          • Deletes itself
                          • Executes dropped EXE
                          • Windows security modification
                          • Checks whether UAC is enabled
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:2676
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~AD76.bat "C:\Windows\system32\Drivers\USBInfo.com"
                            6⤵
                            • Drops file in Drivers directory
                            • Checks computer location settings
                            • Drops desktop.ini file(s)
                            • Drops autorun.inf file
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:3772
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              7⤵
                                PID:4828
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                PID:2416
                              • C:\Windows\SysWOW64\regedit.exe
                                regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Modifies visiblity of hidden/system files in Explorer
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Runs regedit.exe
                                PID:64
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:2932
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1264
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h ╬─╝■╝╨.exe
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:1672
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h autorun.inf
                                7⤵
                                • Drops autorun.inf file
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:1256
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "$Recycle.Bin"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                PID:892
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "Documents and Settings"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:3260
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "PerfLogs"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                PID:4132
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "Program Files"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:2712
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "Program Files (x86)"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:1800
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "ProgramData"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:1736
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "Recovery"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:1072
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "System Volume Information"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:2288
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "Users"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:4508
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "Windows"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:4408
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "recycler.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:5116
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "system volume information.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                PID:1532
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1276
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h ╬─╝■╝╨.exe
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                PID:2700
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "recycler.exe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:3596
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "system volume information.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                PID:5080
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1964
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h ╬─╝■╝╨.exe
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:5088
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h autorun.inf
                                7⤵
                                • Sets file to hidden
                                • Drops autorun.inf file
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:4760
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "$RECYCLE.BIN"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:4400
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +s +h "System Volume Information"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:336
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "recycler.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                PID:552
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "system volume information.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:4596
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                PID:2304
                              • C:\Windows\SysWOW64\regedit.exe
                                regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Modifies visiblity of hidden/system files in Explorer
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Runs regedit.exe
                                PID:1884
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1792
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1152
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h ╬─╝■╝╨.exe
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:1832
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "recycler.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:2808
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "system volume information.exe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:3248
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1352
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h ╬─╝■╝╨.exe
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:4316
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "recycler.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:2060
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "system volume information.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:4480
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:4164
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h ╬─╝■╝╨.exe
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                PID:2368
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "recycler.exe"
                                7⤵
                                • Sets file to hidden
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:2352
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib +a +r +s +h "system volume information.exe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:2416
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                PID:660
                              • C:\Windows\SysWOW64\regedit.exe
                                regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Modifies visiblity of hidden/system files in Explorer
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Runs regedit.exe
                                PID:32
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:972
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                7⤵
                                  PID:2180
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib +a +r +s +h ╬─╝■╝╨.exe
                                  7⤵
                                    PID:892
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib +a +r +s +h "recycler.exe"
                                    7⤵
                                    • Sets file to hidden
                                    • Views/modifies file attributes
                                    PID:976
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib +a +r +s +h "system volume information.exe"
                                    7⤵
                                    • Sets file to hidden
                                    • Views/modifies file attributes
                                    PID:1628
                                  • C:\Windows\SysWOW64\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                    7⤵
                                      PID:4072
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib +a +r +s +h ╬─╝■╝╨.exe
                                      7⤵
                                        PID:2464
                                      • C:\Windows\SysWOW64\attrib.exe
                                        attrib +a +r +s +h "recycler.exe"
                                        7⤵
                                          PID:960
                                        • C:\Windows\SysWOW64\attrib.exe
                                          attrib +a +r +s +h "system volume information.exe"
                                          7⤵
                                          • Sets file to hidden
                                          • Views/modifies file attributes
                                          PID:2272
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                          7⤵
                                            PID:4508
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib +a +r +s +h ╬─╝■╝╨.exe
                                            7⤵
                                            • Views/modifies file attributes
                                            PID:2864
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib +a +r +s +h "recycler.exe"
                                            7⤵
                                            • Sets file to hidden
                                            • Views/modifies file attributes
                                            PID:3932
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib +a +r +s +h "system volume information.exe"
                                            7⤵
                                              PID:3528
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                              7⤵
                                              • Kills process with taskkill
                                              PID:3608
                                            • C:\Windows\SysWOW64\regedit.exe
                                              regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                              7⤵
                                              • Runs regedit.exe
                                              PID:3596
                                            • C:\Windows\SysWOW64\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                              7⤵
                                                PID:5072
                                              • C:\Windows\SysWOW64\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                7⤵
                                                  PID:380
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib +a +r +s +h ╬─╝■╝╨.exe
                                                  7⤵
                                                  • Sets file to hidden
                                                  PID:4628
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib +a +r +s +h "recycler.exe"
                                                  7⤵
                                                  • Sets file to hidden
                                                  • Views/modifies file attributes
                                                  PID:3924
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib +a +r +s +h "system volume information.exe"
                                                  7⤵
                                                  • Sets file to hidden
                                                  • Views/modifies file attributes
                                                  PID:2316
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                  7⤵
                                                    PID:1332
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib +a +r +s +h ╬─╝■╝╨.exe
                                                    7⤵
                                                    • Sets file to hidden
                                                    • Views/modifies file attributes
                                                    PID:3628
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib +a +r +s +h "recycler.exe"
                                                    7⤵
                                                    • Sets file to hidden
                                                    • Views/modifies file attributes
                                                    PID:3704
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib +a +r +s +h "system volume information.exe"
                                                    7⤵
                                                    • Sets file to hidden
                                                    PID:3656
                                                  • C:\Windows\SysWOW64\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                    7⤵
                                                      PID:2752
                                                    • C:\Windows\SysWOW64\attrib.exe
                                                      attrib +a +r +s +h ╬─╝■╝╨.exe
                                                      7⤵
                                                      • Sets file to hidden
                                                      • Views/modifies file attributes
                                                      PID:3880
                                                    • C:\Windows\SysWOW64\attrib.exe
                                                      attrib +a +r +s +h "recycler.exe"
                                                      7⤵
                                                        PID:3672
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib +a +r +s +h "system volume information.exe"
                                                        7⤵
                                                        • Sets file to hidden
                                                        • Views/modifies file attributes
                                                        PID:2868
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                                        7⤵
                                                        • Kills process with taskkill
                                                        PID:1656
                                                      • C:\Windows\SysWOW64\regedit.exe
                                                        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                                        7⤵
                                                        • Runs regedit.exe
                                                        PID:2560
                                                      • C:\Windows\SysWOW64\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                                        7⤵
                                                          PID:4604
                                                        • C:\Windows\SysWOW64\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                          7⤵
                                                            PID:4164
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +a +r +s +h ╬─╝■╝╨.exe
                                                            7⤵
                                                            • Sets file to hidden
                                                            • Views/modifies file attributes
                                                            PID:2352
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +a +r +s +h "recycler.exe"
                                                            7⤵
                                                            • Sets file to hidden
                                                            • Views/modifies file attributes
                                                            PID:1312
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +a +r +s +h "system volume information.exe"
                                                            7⤵
                                                            • Sets file to hidden
                                                            PID:4940
                                                          • C:\Windows\SysWOW64\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                            7⤵
                                                              PID:4992
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib +a +r +s +h ╬─╝■╝╨.exe
                                                              7⤵
                                                              • Sets file to hidden
                                                              • Views/modifies file attributes
                                                              PID:4616
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib +a +r +s +h "recycler.exe"
                                                              7⤵
                                                              • Views/modifies file attributes
                                                              PID:1980
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib +a +r +s +h "system volume information.exe"
                                                              7⤵
                                                              • Views/modifies file attributes
                                                              PID:708
                                                            • C:\Windows\SysWOW64\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                              7⤵
                                                                PID:5032
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                7⤵
                                                                  PID:1012
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  attrib +a +r +s +h "recycler.exe"
                                                                  7⤵
                                                                  • Sets file to hidden
                                                                  • Views/modifies file attributes
                                                                  PID:2180
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  attrib +a +r +s +h "system volume information.exe"
                                                                  7⤵
                                                                    PID:3992
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                                                    7⤵
                                                                    • Kills process with taskkill
                                                                    PID:1688
                                                                  • C:\Windows\SysWOW64\regedit.exe
                                                                    regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                                                    7⤵
                                                                    • Runs regedit.exe
                                                                    PID:4320
                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                                                    7⤵
                                                                      PID:4580
                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                      7⤵
                                                                        PID:4072
                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                        attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                        7⤵
                                                                        • Sets file to hidden
                                                                        PID:4948
                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                        attrib +a +r +s +h "recycler.exe"
                                                                        7⤵
                                                                        • Sets file to hidden
                                                                        • Views/modifies file attributes
                                                                        PID:2908
                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                        attrib +a +r +s +h "system volume information.exe"
                                                                        7⤵
                                                                        • Sets file to hidden
                                                                        • Views/modifies file attributes
                                                                        PID:1136
                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                        7⤵
                                                                          PID:4508
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                          7⤵
                                                                          • Sets file to hidden
                                                                          PID:1532
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib +a +r +s +h "recycler.exe"
                                                                          7⤵
                                                                          • Sets file to hidden
                                                                          PID:4464
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib +a +r +s +h "system volume information.exe"
                                                                          7⤵
                                                                          • Views/modifies file attributes
                                                                          PID:4260
                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                          7⤵
                                                                            PID:3608
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                            7⤵
                                                                              PID:3044
                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                              attrib +a +r +s +h "recycler.exe"
                                                                              7⤵
                                                                                PID:644
                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                attrib +a +r +s +h "system volume information.exe"
                                                                                7⤵
                                                                                  PID:4036
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                                                                  7⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:2884
                                                                                • C:\Windows\SysWOW64\regedit.exe
                                                                                  regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                                                                  7⤵
                                                                                  • Runs regedit.exe
                                                                                  PID:3148
                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                                                                  7⤵
                                                                                    PID:2712
                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                    7⤵
                                                                                      PID:3164
                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                      attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                      7⤵
                                                                                      • Sets file to hidden
                                                                                      • Views/modifies file attributes
                                                                                      PID:3004
                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                      attrib +a +r +s +h "recycler.exe"
                                                                                      7⤵
                                                                                      • Views/modifies file attributes
                                                                                      PID:3532
                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                      attrib +a +r +s +h "system volume information.exe"
                                                                                      7⤵
                                                                                      • Sets file to hidden
                                                                                      PID:456
                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                      7⤵
                                                                                        PID:3424
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                        7⤵
                                                                                        • Sets file to hidden
                                                                                        • Views/modifies file attributes
                                                                                        PID:3628
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib +a +r +s +h "recycler.exe"
                                                                                        7⤵
                                                                                        • Views/modifies file attributes
                                                                                        PID:3704
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib +a +r +s +h "system volume information.exe"
                                                                                        7⤵
                                                                                          PID:3656
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                          7⤵
                                                                                            PID:3064
                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                            attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                            7⤵
                                                                                              PID:2684
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib +a +r +s +h "recycler.exe"
                                                                                              7⤵
                                                                                              • Views/modifies file attributes
                                                                                              PID:2540
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib +a +r +s +h "system volume information.exe"
                                                                                              7⤵
                                                                                              • Sets file to hidden
                                                                                              PID:4524
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                                                                              7⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:2716
                                                                                            • C:\Windows\SysWOW64\regedit.exe
                                                                                              regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                                                                              7⤵
                                                                                              • Runs regedit.exe
                                                                                              PID:4360
                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                                                                              7⤵
                                                                                                PID:2052
                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                7⤵
                                                                                                  PID:648
                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                  attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                  7⤵
                                                                                                  • Sets file to hidden
                                                                                                  PID:4480
                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                  attrib +a +r +s +h "recycler.exe"
                                                                                                  7⤵
                                                                                                  • Sets file to hidden
                                                                                                  PID:3028
                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                  attrib +a +r +s +h "system volume information.exe"
                                                                                                  7⤵
                                                                                                  • Sets file to hidden
                                                                                                  PID:3556
                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                  7⤵
                                                                                                    PID:1724
                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                    attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                    7⤵
                                                                                                    • Sets file to hidden
                                                                                                    • Views/modifies file attributes
                                                                                                    PID:1448
                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                    attrib +a +r +s +h "recycler.exe"
                                                                                                    7⤵
                                                                                                    • Sets file to hidden
                                                                                                    PID:404
                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                    attrib +a +r +s +h "system volume information.exe"
                                                                                                    7⤵
                                                                                                    • Views/modifies file attributes
                                                                                                    PID:660
                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                    7⤵
                                                                                                      PID:2360
                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                      attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                      7⤵
                                                                                                      • Sets file to hidden
                                                                                                      • Views/modifies file attributes
                                                                                                      PID:4052
                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                      attrib +a +r +s +h "recycler.exe"
                                                                                                      7⤵
                                                                                                        PID:4912
                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                        attrib +a +r +s +h "system volume information.exe"
                                                                                                        7⤵
                                                                                                        • Sets file to hidden
                                                                                                        PID:1248
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                                                                                        7⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:3468
                                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                                        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                                                                                        7⤵
                                                                                                        • Runs regedit.exe
                                                                                                        PID:708
                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                                                                                        7⤵
                                                                                                          PID:540
                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                          7⤵
                                                                                                            PID:4960
                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                            attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                            7⤵
                                                                                                            • Sets file to hidden
                                                                                                            • Views/modifies file attributes
                                                                                                            PID:4224
                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                            attrib +a +r +s +h "recycler.exe"
                                                                                                            7⤵
                                                                                                            • Sets file to hidden
                                                                                                            • Views/modifies file attributes
                                                                                                            PID:1756
                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                            attrib +a +r +s +h "system volume information.exe"
                                                                                                            7⤵
                                                                                                            • Sets file to hidden
                                                                                                            PID:4540
                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                            7⤵
                                                                                                              PID:2464
                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                              attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                              7⤵
                                                                                                              • Sets file to hidden
                                                                                                              • Views/modifies file attributes
                                                                                                              PID:3056
                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                              attrib +a +r +s +h "recycler.exe"
                                                                                                              7⤵
                                                                                                              • Sets file to hidden
                                                                                                              PID:3120
                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                              attrib +a +r +s +h "system volume information.exe"
                                                                                                              7⤵
                                                                                                                PID:672
                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                                7⤵
                                                                                                                  PID:2864
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                                  7⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:3932
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib +a +r +s +h "recycler.exe"
                                                                                                                  7⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:4812
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib +a +r +s +h "system volume information.exe"
                                                                                                                  7⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:2472
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                                                                                                  7⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:3140
                                                                                                                • C:\Windows\SysWOW64\regedit.exe
                                                                                                                  regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                                                                                                  7⤵
                                                                                                                  • Runs regedit.exe
                                                                                                                  PID:2860
                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                                                                                                  7⤵
                                                                                                                    PID:3044
                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                                    7⤵
                                                                                                                      PID:1732
                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                      attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                                      7⤵
                                                                                                                      • Sets file to hidden
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:4040
                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                      attrib +a +r +s +h "recycler.exe"
                                                                                                                      7⤵
                                                                                                                        PID:1896
                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                        attrib +a +r +s +h "system volume information.exe"
                                                                                                                        7⤵
                                                                                                                        • Sets file to hidden
                                                                                                                        • Views/modifies file attributes
                                                                                                                        PID:3768
                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                                        7⤵
                                                                                                                          PID:736
                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                          attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                                          7⤵
                                                                                                                            PID:2060
                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                            attrib +a +r +s +h "recycler.exe"
                                                                                                                            7⤵
                                                                                                                            • Sets file to hidden
                                                                                                                            • Views/modifies file attributes
                                                                                                                            PID:4592
                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                            attrib +a +r +s +h "system volume information.exe"
                                                                                                                            7⤵
                                                                                                                            • Sets file to hidden
                                                                                                                            • Views/modifies file attributes
                                                                                                                            PID:5088
                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
                                                                                                                            7⤵
                                                                                                                              PID:3592
                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                              attrib +a +r +s +h ╬─╝■╝╨.exe
                                                                                                                              7⤵
                                                                                                                              • Views/modifies file attributes
                                                                                                                              PID:864
                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                              attrib +a +r +s +h "recycler.exe"
                                                                                                                              7⤵
                                                                                                                              • Sets file to hidden
                                                                                                                              PID:2468
                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                              attrib +a +r +s +h "system volume information.exe"
                                                                                                                              7⤵
                                                                                                                              • Views/modifies file attributes
                                                                                                                              PID:3004
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
                                                                                                                              7⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              PID:4748
                                                                                                                            • C:\Windows\SysWOW64\regedit.exe
                                                                                                                              regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
                                                                                                                              7⤵
                                                                                                                              • Runs regedit.exe
                                                                                                                              PID:3680
                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
                                                                                                                              7⤵
                                                                                                                                PID:2856
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                    1⤵
                                                                                                                      PID:3616
                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                      1⤵
                                                                                                                        PID:3816
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:3912
                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:3976
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:4056
                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:4156
                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                                                                                                1⤵
                                                                                                                                  PID:1568
                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:5044

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Reconnaissance

                                                                                                                                  Resource Development

                                                                                                                                  Initial Access

                                                                                                                                  Replication Through Removable Media

                                                                                                                                  1
                                                                                                                                  T1091

                                                                                                                                  Execution

                                                                                                                                  Persistence

                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                  1
                                                                                                                                  T1547

                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                  1
                                                                                                                                  T1547.001

                                                                                                                                  Create or Modify System Process

                                                                                                                                  1
                                                                                                                                  T1543

                                                                                                                                  Windows Service

                                                                                                                                  1
                                                                                                                                  T1543.003

                                                                                                                                  Privilege Escalation

                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                  1
                                                                                                                                  T1548

                                                                                                                                  Bypass User Account Control

                                                                                                                                  1
                                                                                                                                  T1548.002

                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                  1
                                                                                                                                  T1547

                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                  1
                                                                                                                                  T1547.001

                                                                                                                                  Create or Modify System Process

                                                                                                                                  1
                                                                                                                                  T1543

                                                                                                                                  Windows Service

                                                                                                                                  1
                                                                                                                                  T1543.003

                                                                                                                                  Defense Evasion

                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                  1
                                                                                                                                  T1548

                                                                                                                                  Bypass User Account Control

                                                                                                                                  1
                                                                                                                                  T1548.002

                                                                                                                                  Hide Artifacts

                                                                                                                                  4
                                                                                                                                  T1564

                                                                                                                                  Hidden Files and Directories

                                                                                                                                  4
                                                                                                                                  T1564.001

                                                                                                                                  Impair Defenses

                                                                                                                                  4
                                                                                                                                  T1562

                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                  1
                                                                                                                                  T1562.004

                                                                                                                                  Disable or Modify Tools

                                                                                                                                  3
                                                                                                                                  T1562.001

                                                                                                                                  Modify Registry

                                                                                                                                  8
                                                                                                                                  T1112

                                                                                                                                  Credential Access

                                                                                                                                  Discovery

                                                                                                                                  Peripheral Device Discovery

                                                                                                                                  1
                                                                                                                                  T1120

                                                                                                                                  Query Registry

                                                                                                                                  2
                                                                                                                                  T1012

                                                                                                                                  System Information Discovery

                                                                                                                                  4
                                                                                                                                  T1082

                                                                                                                                  System Location Discovery

                                                                                                                                  1
                                                                                                                                  T1614

                                                                                                                                  System Language Discovery

                                                                                                                                  1
                                                                                                                                  T1614.001

                                                                                                                                  Lateral Movement

                                                                                                                                  Replication Through Removable Media

                                                                                                                                  1
                                                                                                                                  T1091

                                                                                                                                  Collection

                                                                                                                                  Command and Control

                                                                                                                                  Exfiltration

                                                                                                                                  Impact

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\~9124.bat
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    MD5

                                                                                                                                    bc278224d87330dbedf84ddefdced3f1

                                                                                                                                    SHA1

                                                                                                                                    0a21b60897db6bd7559fef583bb095266110b653

                                                                                                                                    SHA256

                                                                                                                                    1d75230f2ab4daeb62d42bb1bea8a5c4c9f6831f3830407f9615677dc29dac7a

                                                                                                                                    SHA512

                                                                                                                                    6ff654c73c68420d97657657f77d3934aaa60fddceca095d0f9d3f169e6fab7435d3a758f0d3eae086b2ee32ea7e5c0fa3ba602bc9416e0e1e2ca8743f0d846a

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Windows\SYSTEM.INI
                                                                                                                                    Filesize

                                                                                                                                    257B

                                                                                                                                    MD5

                                                                                                                                    64af78e8c03cb4049de251b2c99a6b0c

                                                                                                                                    SHA1

                                                                                                                                    ee4274481ee157aebb04b6e25ac5ee40b94c5c64

                                                                                                                                    SHA256

                                                                                                                                    7ca382d965a0816295f2ef17c73f59a72d48194518be664fd1c20383a65157ea

                                                                                                                                    SHA512

                                                                                                                                    b3e4a27e6bfb651c1ff6dde0ff555bb3e6ad5a16c044f0a25926e20f607c81b4d29ec10c78d250d473145d4f762854c4d8a5390e9c5698c3d61f2a3ad78492e1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Windows\SysWOW64\Drivers\USBInfo.vbe
                                                                                                                                    Filesize

                                                                                                                                    77B

                                                                                                                                    MD5

                                                                                                                                    54ceb8eabaff522c097e4949d39fbd09

                                                                                                                                    SHA1

                                                                                                                                    304fd3c274aac25477ba1f3f500ae34e6c94612d

                                                                                                                                    SHA256

                                                                                                                                    d2d64a938a71d1b747112176eeb345991433fc81475a397b85b6b4c3d97f8550

                                                                                                                                    SHA512

                                                                                                                                    3c6ce4fe30121305b176a3ccc7358343bfdd28537358e7289e4354b52f152c018acfe843659df5bd35228fca804b0285baa8350e2b6ca39719bdefdb77b2e0be

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Windows\SysWOW64\Drivers\USBStor.vbe
                                                                                                                                    Filesize

                                                                                                                                    20B

                                                                                                                                    MD5

                                                                                                                                    905d7a48a13a75ced1342bbdf0a3ace2

                                                                                                                                    SHA1

                                                                                                                                    3bcc021a82ed38810bcf61286eb1f4e578e3721f

                                                                                                                                    SHA256

                                                                                                                                    10338a72fbacb4fdf731d8937cdf23519896c5122b6a80079527cebf8406b3cd

                                                                                                                                    SHA512

                                                                                                                                    fe77b8b928ba1ffb1a8bf941b2a0279b3ca6512d30dd1a2e2f363f9b2be245e361fab40232bc868f0f7e79bacc476653a49b66d2cf6945ed87b0c776783db8c1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Windows\SysWOW64\Drivers\USBSys.vbe
                                                                                                                                    Filesize

                                                                                                                                    19B

                                                                                                                                    MD5

                                                                                                                                    322866ac1312f3bc0dd8685949f35b6a

                                                                                                                                    SHA1

                                                                                                                                    dc3f64764aa99595ee48721142d2301ebbe07aec

                                                                                                                                    SHA256

                                                                                                                                    5417fd3704beb2760ed54c38048ae44d2cd49312be2a8f104e542bbd5bbc88d6

                                                                                                                                    SHA512

                                                                                                                                    1b5c2320beaeb34895a1d11882566463d365a128db4d260189850990e1215ce737334ee96b43ecd2c018f040548209cc6f11328a5a9b9eb5f57fc6ac61afe03d

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Windows\SysWOW64\drivers\USBInfo.com
                                                                                                                                    Filesize

                                                                                                                                    147KB

                                                                                                                                    MD5

                                                                                                                                    75c865f1747b242051eb6a05e91f915a

                                                                                                                                    SHA1

                                                                                                                                    624e32dc35c81331bee657174ba5744ab262564b

                                                                                                                                    SHA256

                                                                                                                                    ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc

                                                                                                                                    SHA512

                                                                                                                                    b5ca5b998a12cede7c11cac166d6f839c3ba4cbd7a22b6cdfb0385cb42ebd2e94c163543d826419f05f4cd4780e3f72003ae20d69b6ac7bebe4afadf48926cea

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Windows\SysWOW64\drivers\USBInfo.sy_
                                                                                                                                    Filesize

                                                                                                                                    1KB

                                                                                                                                    MD5

                                                                                                                                    e3f32bf45469d18567e23485109ffdd4

                                                                                                                                    SHA1

                                                                                                                                    2e207b073a4237e05b5da89f9ca2e9771757620c

                                                                                                                                    SHA256

                                                                                                                                    e41ad345599c751ed8b124229df31681f2c44d322d092f85c2205b97f09c8a81

                                                                                                                                    SHA512

                                                                                                                                    e8ab034c883c747d6a093d1221e080adf84a1c3662e4469c59cf49f693561262d435c28eede60e18151222fd9562abc6c81b6a57fa5587032cbc2d0b74a0c0e5

                                                                                                                                    Download Submit

                                                                                                                                  • C:\autorun.inf
                                                                                                                                    Filesize

                                                                                                                                    149B

                                                                                                                                    MD5

                                                                                                                                    babb9292822f6963475088494e446a00

                                                                                                                                    SHA1

                                                                                                                                    d0f96ea279562a899f24b5a6905065de029877b0

                                                                                                                                    SHA256

                                                                                                                                    bff5694d6d4c8a41217fa9d98d95c355a6f63ef939a4ef89bc45d1cf443a1f9d

                                                                                                                                    SHA512

                                                                                                                                    b96daa0a52867f7f0454c8b35d85682aa22c3ac59495760c95204cc1cfc419bd88b5cc59d92dfab5a6343f8f86659e35e2f38cda0c1ea014d2377ab5e525fd5b

                                                                                                                                    Download Submit

                                                                                                                                  • C:\desktop.ini
                                                                                                                                    Filesize

                                                                                                                                    150B

                                                                                                                                    MD5

                                                                                                                                    ec4064ac609dc25d680be76463282759

                                                                                                                                    SHA1

                                                                                                                                    e811243e6946ab739afe39f79e7e010c5d3aa646

                                                                                                                                    SHA256

                                                                                                                                    5f7b66850209b68edce639f55db86876840969a4302143811f5953b643f45dae

                                                                                                                                    SHA512

                                                                                                                                    e65ad34b719c46d97729167cd0c8ed0ba8a9ee567b67a4663ddc48873735914c28315428b8415ced78a7608165910dcb4583222b08e3e1a7cabf7b3e9339401f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\gvxt.exe
                                                                                                                                    Filesize

                                                                                                                                    100KB

                                                                                                                                    MD5

                                                                                                                                    e4154fefcf81d5ec02df2083093d4c3d

                                                                                                                                    SHA1

                                                                                                                                    2012fec3d47e5763d93099ed3868e750e2bd14b7

                                                                                                                                    SHA256

                                                                                                                                    2899f067770cf2334d24a0852300066fd91d860585d0ae01693db3f779188707

                                                                                                                                    SHA512

                                                                                                                                    1fb847d2a916d9338c86b33f538cfa7daf94f6058bb48dc849cac2e293a78f41dde3f64bebb697f82fc422a4416506d2a701937012ae3fab190a3183e24bd323

                                                                                                                                    Download Submit

                                                                                                                                  • F:\desktop.ini
                                                                                                                                    Filesize

                                                                                                                                    41B

                                                                                                                                    MD5

                                                                                                                                    fc58af21d2445196d228547ba36ce949

                                                                                                                                    SHA1

                                                                                                                                    f5eade25a4c478faa988d62ad7f93679a148e511

                                                                                                                                    SHA256

                                                                                                                                    93bd2fd7de32217b93b299ccf87fe53d47f5c1f1b44dbcfa3921f10d405d026e

                                                                                                                                    SHA512

                                                                                                                                    eabe18f6d152fd1f4450d618ed0084990f90071cc18d42812a68339d3fd55c8b4a4ce03fb575730a2188a8ce3bfb15c275ad6a00820902a3737723220fdd4427

                                                                                                                                    Download Submit

                                                                                                                                  • memory/1792-142-0x0000000003420000-0x0000000003422000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1792-141-0x0000000003570000-0x0000000003571000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2044-16-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2044-21-0x00000000003B0000-0x00000000003B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2044-19-0x00000000003B0000-0x00000000003B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2044-46-0x00000000003B0000-0x00000000003B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-45-0x0000000002230000-0x0000000002232000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-54-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-29-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-30-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-31-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-32-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-33-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-35-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-36-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-37-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-12-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-0-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-67-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-10-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-1-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-17-0x0000000002230000-0x0000000002232000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-13-0x0000000002230000-0x0000000002232000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-14-0x00000000044E0000-0x00000000044E1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-11-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-9-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-7-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-18-0x0000000002230000-0x0000000002232000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-6-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-5-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2368-8-0x0000000002350000-0x00000000033DE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-132-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-137-0x0000000000710000-0x0000000000711000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-143-0x0000000000700000-0x0000000000702000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-128-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-131-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-130-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-127-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-343-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-126-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-135-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-124-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-129-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-134-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-146-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/2676-133-0x0000000002390000-0x000000000341E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/3772-139-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3772-144-0x0000000000620000-0x0000000000622000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download