Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2024 14:12

General

  • Target

    e1d352f2b8632d80920f486f54e8a806_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    e1d352f2b8632d80920f486f54e8a806

  • SHA1

    64adc78b47c8deb4e62152f15bfa0a258818f020

  • SHA256

    fbeb235e9a95e4cfefd6fe2201e3bf9350eb23f79a98c449613951c2384c4671

  • SHA512

    70d6a300c8282f1db4e395a364999879a8329d113fca8c119e928e66100f4cb6098c41c7fab7e5f9ff348495944d505cf5764dbcbd3f349c7998ee0cc1835a74

  • SSDEEP

    24576:axpuMVkynnbwNvDIVhpCeOHR8fxZUzx3OF9jx:epZnnMNvEhppqR8HUlePjx

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 25 IoCs
  • Sets file to hidden 1 TTPs 48 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 50 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 25 IoCs
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 48 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1d352f2b8632d80920f486f54e8a806_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e1d352f2b8632d80920f486f54e8a806_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\hh.exe
      "C:\Users\Admin\AppData\Local\Temp\hh.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\hh.exe" +s +h
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2880
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\hh.exe" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:648
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:2888
      • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
        "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\hh.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 4
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2000
      • C:\Windows\SysWOW64\svc\svch0stc.exe
        "C:\Windows\system32\svc\svch0stc.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
            5⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:2948
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
          4⤵
            PID:1440
            • C:\Windows\SysWOW64\attrib.exe
              attrib "C:\Windows\SysWOW64\svc" +s +h
              5⤵
              • Sets file to hidden
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2084
          • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
            "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
            4⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:3056
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1564
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 4
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1096
          • C:\Windows\SysWOW64\svc\svch0stc.exe
            "C:\Windows\system32\svc\svch0stc.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1128
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
              5⤵
              • System Location Discovery: System Language Discovery
              PID:956
              • C:\Windows\SysWOW64\attrib.exe
                attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                6⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:1508
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
              5⤵
                PID:1736
                • C:\Windows\SysWOW64\attrib.exe
                  attrib "C:\Windows\SysWOW64\svc" +s +h
                  6⤵
                  • Sets file to hidden
                  • Drops file in System32 directory
                  • Views/modifies file attributes
                  PID:840
              • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                5⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                PID:2008
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:236
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 4
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1832
              • C:\Windows\SysWOW64\svc\svch0stc.exe
                "C:\Windows\system32\svc\svch0stc.exe"
                5⤵
                • Modifies WinLogon for persistence
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Drops file in System32 directory
                PID:1848
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                  6⤵
                    PID:2076
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                      7⤵
                      • Sets file to hidden
                      • Views/modifies file attributes
                      PID:1576
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2408
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib "C:\Windows\SysWOW64\svc" +s +h
                      7⤵
                      • Sets file to hidden
                      • Drops file in System32 directory
                      • Views/modifies file attributes
                      PID:2064
                  • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                    "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of FindShellTrayWindow
                    PID:820
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:2884
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 4
                      7⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:1956
                  • C:\Windows\SysWOW64\svc\svch0stc.exe
                    "C:\Windows\system32\svc\svch0stc.exe"
                    6⤵
                    • Modifies WinLogon for persistence
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    PID:2468
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:2740
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                        8⤵
                        • Sets file to hidden
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Views/modifies file attributes
                        PID:1708
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                      7⤵
                        PID:2300
                        • C:\Windows\SysWOW64\attrib.exe
                          attrib "C:\Windows\SysWOW64\svc" +s +h
                          8⤵
                          • Sets file to hidden
                          • Views/modifies file attributes
                          PID:2744
                      • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                        "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                        7⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        PID:2380
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                        7⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:1704
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 4
                          8⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:268
                      • C:\Windows\SysWOW64\svc\svch0stc.exe
                        "C:\Windows\system32\svc\svch0stc.exe"
                        7⤵
                        • Modifies WinLogon for persistence
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        PID:1032
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                          8⤵
                            PID:2140
                            • C:\Windows\SysWOW64\attrib.exe
                              attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                              9⤵
                              • Sets file to hidden
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Views/modifies file attributes
                              PID:3052
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                            8⤵
                              PID:2776
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib "C:\Windows\SysWOW64\svc" +s +h
                                9⤵
                                • Sets file to hidden
                                • Drops file in System32 directory
                                • Views/modifies file attributes
                                PID:3064
                            • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                              "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of FindShellTrayWindow
                              PID:1864
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                              8⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              PID:2484
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 127.0.0.1 -n 4
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:1144
                            • C:\Windows\SysWOW64\svc\svch0stc.exe
                              "C:\Windows\system32\svc\svch0stc.exe"
                              8⤵
                              • Modifies WinLogon for persistence
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              • Drops file in System32 directory
                              PID:1276
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                9⤵
                                  PID:1640
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                    10⤵
                                    • Sets file to hidden
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Views/modifies file attributes
                                    PID:1508
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                  9⤵
                                    PID:1632
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib "C:\Windows\SysWOW64\svc" +s +h
                                      10⤵
                                      • Sets file to hidden
                                      • Drops file in System32 directory
                                      • Views/modifies file attributes
                                      PID:952
                                  • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                    "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                    9⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    PID:920
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                    9⤵
                                    • System Location Discovery: System Language Discovery
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    PID:1768
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1 -n 4
                                      10⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:1492
                                  • C:\Windows\SysWOW64\svc\svch0stc.exe
                                    "C:\Windows\system32\svc\svch0stc.exe"
                                    9⤵
                                    • Modifies WinLogon for persistence
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Drops file in System32 directory
                                    PID:1644
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                      10⤵
                                        PID:2536
                                        • C:\Windows\SysWOW64\attrib.exe
                                          attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                          11⤵
                                          • Sets file to hidden
                                          • Views/modifies file attributes
                                          PID:2024
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                        10⤵
                                          PID:1480
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib "C:\Windows\SysWOW64\svc" +s +h
                                            11⤵
                                            • Sets file to hidden
                                            • Views/modifies file attributes
                                            PID:2696
                                        • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                          "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                          10⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of FindShellTrayWindow
                                          PID:2560
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                          10⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          PID:536
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.1 -n 4
                                            11⤵
                                            • System Location Discovery: System Language Discovery
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:2824
                                        • C:\Windows\SysWOW64\svc\svch0stc.exe
                                          "C:\Windows\system32\svc\svch0stc.exe"
                                          10⤵
                                          • Modifies WinLogon for persistence
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Drops file in System32 directory
                                          PID:2528
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                            11⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2304
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                              12⤵
                                              • Sets file to hidden
                                              • Views/modifies file attributes
                                              PID:2748
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                            11⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2336
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib "C:\Windows\SysWOW64\svc" +s +h
                                              12⤵
                                              • Sets file to hidden
                                              • System Location Discovery: System Language Discovery
                                              • Views/modifies file attributes
                                              PID:2404
                                          • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                            "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                            11⤵
                                            • Executes dropped EXE
                                            • Suspicious use of FindShellTrayWindow
                                            PID:2876
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                            11⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            PID:2728
                                            • C:\Windows\SysWOW64\PING.EXE
                                              ping 127.0.0.1 -n 4
                                              12⤵
                                              • System Location Discovery: System Language Discovery
                                              • System Network Configuration Discovery: Internet Connection Discovery
                                              • Runs ping.exe
                                              PID:2084
                                          • C:\Windows\SysWOW64\svc\svch0stc.exe
                                            "C:\Windows\system32\svc\svch0stc.exe"
                                            11⤵
                                            • Modifies WinLogon for persistence
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • Drops file in System32 directory
                                            PID:2288
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                              12⤵
                                                PID:2720
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                  13⤵
                                                  • Sets file to hidden
                                                  • Drops file in System32 directory
                                                  • Views/modifies file attributes
                                                  PID:864
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                12⤵
                                                  PID:1756
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib "C:\Windows\SysWOW64\svc" +s +h
                                                    13⤵
                                                    • Sets file to hidden
                                                    • System Location Discovery: System Language Discovery
                                                    • Views/modifies file attributes
                                                    PID:2864
                                                • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                  "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                  12⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:2808
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                  12⤵
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  PID:1332
                                                  • C:\Windows\SysWOW64\PING.EXE
                                                    ping 127.0.0.1 -n 4
                                                    13⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:1140
                                                • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                  "C:\Windows\system32\svc\svch0stc.exe"
                                                  12⤵
                                                  • Modifies WinLogon for persistence
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Adds Run key to start application
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1760
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                    13⤵
                                                      PID:2020
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                        14⤵
                                                        • Sets file to hidden
                                                        • Drops file in System32 directory
                                                        • Views/modifies file attributes
                                                        PID:2896
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                      13⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:812
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib "C:\Windows\SysWOW64\svc" +s +h
                                                        14⤵
                                                        • Sets file to hidden
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Views/modifies file attributes
                                                        PID:1576
                                                    • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                      "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                      13⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:2148
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                      13⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      PID:2796
                                                      • C:\Windows\SysWOW64\PING.EXE
                                                        ping 127.0.0.1 -n 4
                                                        14⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:1004
                                                    • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                      "C:\Windows\system32\svc\svch0stc.exe"
                                                      13⤵
                                                      • Modifies WinLogon for persistence
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2552
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                        14⤵
                                                          PID:2364
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                            15⤵
                                                            • Sets file to hidden
                                                            • Views/modifies file attributes
                                                            PID:2600
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                          14⤵
                                                            PID:2656
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib "C:\Windows\SysWOW64\svc" +s +h
                                                              15⤵
                                                              • Sets file to hidden
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Views/modifies file attributes
                                                              PID:1236
                                                          • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                            "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                            14⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:2468
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                            14⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:2152
                                                            • C:\Windows\SysWOW64\PING.EXE
                                                              ping 127.0.0.1 -n 4
                                                              15⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:2084
                                                          • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                            "C:\Windows\system32\svc\svch0stc.exe"
                                                            14⤵
                                                            • Modifies WinLogon for persistence
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2192
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                              15⤵
                                                                PID:2348
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                  16⤵
                                                                  • Sets file to hidden
                                                                  • Drops file in System32 directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Views/modifies file attributes
                                                                  PID:952
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                15⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2844
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                  16⤵
                                                                  • Sets file to hidden
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Views/modifies file attributes
                                                                  PID:908
                                                              • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                15⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:1928
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                15⤵
                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                PID:1752
                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                  ping 127.0.0.1 -n 4
                                                                  16⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:2320
                                                              • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                "C:\Windows\system32\svc\svch0stc.exe"
                                                                15⤵
                                                                • Modifies WinLogon for persistence
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Adds Run key to start application
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1764
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                  16⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1728
                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                    attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                    17⤵
                                                                    • Sets file to hidden
                                                                    • Drops file in System32 directory
                                                                    • Views/modifies file attributes
                                                                    PID:2764
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                  16⤵
                                                                    PID:1664
                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                      attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                      17⤵
                                                                      • Sets file to hidden
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Views/modifies file attributes
                                                                      PID:2992
                                                                  • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                    "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                    16⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:2804
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                    16⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    PID:2816
                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                      ping 127.0.0.1 -n 4
                                                                      17⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:2908
                                                                  • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                    "C:\Windows\system32\svc\svch0stc.exe"
                                                                    16⤵
                                                                    • Modifies WinLogon for persistence
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    PID:1396
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                      17⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1572
                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                        attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                        18⤵
                                                                        • Sets file to hidden
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Views/modifies file attributes
                                                                        PID:2212
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                      17⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2000
                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                        attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                        18⤵
                                                                        • Sets file to hidden
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Views/modifies file attributes
                                                                        PID:2232
                                                                    • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                      "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                      17⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:1528
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                      17⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      PID:676
                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                        ping 127.0.0.1 -n 4
                                                                        18⤵
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        • Runs ping.exe
                                                                        PID:936
                                                                    • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                      "C:\Windows\system32\svc\svch0stc.exe"
                                                                      17⤵
                                                                      • Modifies WinLogon for persistence
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Adds Run key to start application
                                                                      • Drops file in System32 directory
                                                                      PID:1544
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                        18⤵
                                                                          PID:2436
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                            19⤵
                                                                            • Sets file to hidden
                                                                            • Views/modifies file attributes
                                                                            PID:2820
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                          18⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1976
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                            19⤵
                                                                            • Sets file to hidden
                                                                            • Drops file in System32 directory
                                                                            • Views/modifies file attributes
                                                                            PID:1344
                                                                        • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                          "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                          18⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:944
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                          18⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          PID:900
                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                            ping 127.0.0.1 -n 4
                                                                            19⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Runs ping.exe
                                                                            PID:2780
                                                                        • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                          "C:\Windows\system32\svc\svch0stc.exe"
                                                                          18⤵
                                                                          • Modifies WinLogon for persistence
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Adds Run key to start application
                                                                          • Drops file in System32 directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1096
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                            19⤵
                                                                              PID:2340
                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                20⤵
                                                                                • Sets file to hidden
                                                                                • Views/modifies file attributes
                                                                                PID:648
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                              19⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2756
                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                20⤵
                                                                                • Sets file to hidden
                                                                                • Views/modifies file attributes
                                                                                PID:2108
                                                                            • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                              "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                              19⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:2380
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                              19⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              PID:864
                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                ping 127.0.0.1 -n 4
                                                                                20⤵
                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                • Runs ping.exe
                                                                                PID:2432
                                                                            • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                              "C:\Windows\system32\svc\svch0stc.exe"
                                                                              19⤵
                                                                              • Modifies WinLogon for persistence
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Adds Run key to start application
                                                                              • Drops file in System32 directory
                                                                              PID:840
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                20⤵
                                                                                  PID:2400
                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                    attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                    21⤵
                                                                                    • Sets file to hidden
                                                                                    • Drops file in System32 directory
                                                                                    • Views/modifies file attributes
                                                                                    PID:2220
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                  20⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2320
                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                    attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                    21⤵
                                                                                    • Sets file to hidden
                                                                                    • Drops file in System32 directory
                                                                                    • Views/modifies file attributes
                                                                                    PID:2992
                                                                                • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                                  "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                                  20⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:2368
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                                  20⤵
                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                  PID:2148
                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                    ping 127.0.0.1 -n 4
                                                                                    21⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    • Runs ping.exe
                                                                                    PID:1324
                                                                                • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                                  "C:\Windows\system32\svc\svch0stc.exe"
                                                                                  20⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Adds Run key to start application
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2804
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                    21⤵
                                                                                      PID:2552
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                        22⤵
                                                                                        • Sets file to hidden
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Views/modifies file attributes
                                                                                        PID:2064
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                      21⤵
                                                                                        PID:2468
                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                          attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                          22⤵
                                                                                          • Sets file to hidden
                                                                                          • Drops file in System32 directory
                                                                                          • Views/modifies file attributes
                                                                                          PID:1912
                                                                                      • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                                        "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                                        21⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        PID:2384
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                                        21⤵
                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                        PID:1576
                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                          ping 127.0.0.1 -n 4
                                                                                          22⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          • Runs ping.exe
                                                                                          PID:1760
                                                                                      • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                                        "C:\Windows\system32\svc\svch0stc.exe"
                                                                                        21⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Adds Run key to start application
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:952
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                          22⤵
                                                                                            PID:2396
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                              23⤵
                                                                                              • Sets file to hidden
                                                                                              • Views/modifies file attributes
                                                                                              PID:1432
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                            22⤵
                                                                                              PID:2892
                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                23⤵
                                                                                                • Sets file to hidden
                                                                                                • Views/modifies file attributes
                                                                                                PID:2312
                                                                                            • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                                              "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                                              22⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              PID:2200
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                                              22⤵
                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                              PID:2096
                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                ping 127.0.0.1 -n 4
                                                                                                23⤵
                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                • Runs ping.exe
                                                                                                PID:2024
                                                                                            • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                                              "C:\Windows\system32\svc\svch0stc.exe"
                                                                                              22⤵
                                                                                              • Modifies WinLogon for persistence
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Adds Run key to start application
                                                                                              • Drops file in System32 directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1272
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                23⤵
                                                                                                  PID:2532
                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                    attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                    24⤵
                                                                                                    • Sets file to hidden
                                                                                                    • Views/modifies file attributes
                                                                                                    PID:1096
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                  23⤵
                                                                                                    PID:1156
                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                      attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                      24⤵
                                                                                                      • Sets file to hidden
                                                                                                      • Drops file in System32 directory
                                                                                                      • Views/modifies file attributes
                                                                                                      PID:2600
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                                                    23⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:1724
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                                                    23⤵
                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                    PID:2448
                                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                                      ping 127.0.0.1 -n 4
                                                                                                      24⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                      • Runs ping.exe
                                                                                                      PID:3036
                                                                                                  • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                                                    "C:\Windows\system32\svc\svch0stc.exe"
                                                                                                    23⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Drops file in System32 directory
                                                                                                    PID:2808
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                      24⤵
                                                                                                        PID:2200
                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                          attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                          25⤵
                                                                                                          • Sets file to hidden
                                                                                                          • Drops file in System32 directory
                                                                                                          • Views/modifies file attributes
                                                                                                          PID:1296
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                        24⤵
                                                                                                          PID:2512
                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                            attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                            25⤵
                                                                                                            • Sets file to hidden
                                                                                                            • Drops file in System32 directory
                                                                                                            • Views/modifies file attributes
                                                                                                            PID:268
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                                                          24⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          PID:2668
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                                                          24⤵
                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                          PID:3016
                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                            ping 127.0.0.1 -n 4
                                                                                                            25⤵
                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                            • Runs ping.exe
                                                                                                            PID:600
                                                                                                        • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                                                          "C:\Windows\system32\svc\svch0stc.exe"
                                                                                                          24⤵
                                                                                                          • Modifies WinLogon for persistence
                                                                                                          • Executes dropped EXE
                                                                                                          • Adds Run key to start application
                                                                                                          • Drops file in System32 directory
                                                                                                          PID:1636
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                            25⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2388
                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                              attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                              26⤵
                                                                                                              • Sets file to hidden
                                                                                                              • Views/modifies file attributes
                                                                                                              PID:2424
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                            25⤵
                                                                                                              PID:2652
                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                                26⤵
                                                                                                                • Sets file to hidden
                                                                                                                • Views/modifies file attributes
                                                                                                                PID:2752
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                                                              25⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:908
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                                                              25⤵
                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                              PID:1724
                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                ping 127.0.0.1 -n 4
                                                                                                                26⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                • Runs ping.exe
                                                                                                                PID:2544
                                                                                                            • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                                                              "C:\Windows\system32\svc\svch0stc.exe"
                                                                                                              25⤵
                                                                                                              • Modifies WinLogon for persistence
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              • Drops file in System32 directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:1492
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                                26⤵
                                                                                                                  PID:2424
                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                    attrib "C:\Windows\SysWOW64\svc\svch0stc.exe" +s +h
                                                                                                                    27⤵
                                                                                                                    • Sets file to hidden
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Views/modifies file attributes
                                                                                                                    PID:1000
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                                  26⤵
                                                                                                                    PID:2212
                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                      attrib "C:\Windows\SysWOW64\svc" +s +h
                                                                                                                      27⤵
                                                                                                                      • Sets file to hidden
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:1804
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\129660.DEVID.INFO.EXE"
                                                                                                                    26⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    PID:1636
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\svc\svch0stc.exe"
                                                                                                                    26⤵
                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                    PID:908
                                                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                                                      ping 127.0.0.1 -n 4
                                                                                                                      27⤵
                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                      • Runs ping.exe
                                                                                                                      PID:2380
                                                                                                                  • C:\Windows\SysWOW64\svc\svch0stc.exe
                                                                                                                    "C:\Windows\system32\svc\svch0stc.exe"
                                                                                                                    26⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1324
                                                                  • C:\Users\Admin\AppData\Local\Temp\129660.devid.info.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\129660.devid.info.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:2816

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\devconx86.exe

                                                                  Filesize

                                                                  54KB

                                                                  MD5

                                                                  c4b470269324517ee838789c7cf5e606

                                                                  SHA1

                                                                  7005597d55fb26c6260e0772f301c79f030e6d56

                                                                  SHA256

                                                                  5f9b898315ad8192e87e21a499fd87d31b886513bb39d368476174aaa89a2bf9

                                                                  SHA512

                                                                  dbadca544434a847238bf107e59aa84bf8df9df899d0c2da2ee62cc28e12d175a81d4e4e0f85d7c394323bf66fb4ac0f413c949700ecdec9a73ed5cf9340aebb

                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\devid.info.setup.exe

                                                                  Filesize

                                                                  124KB

                                                                  MD5

                                                                  53b4d555c26e8ab79f37b1a080bd1021

                                                                  SHA1

                                                                  0ecb19d93247302667667537c80091c8b20b52a7

                                                                  SHA256

                                                                  7ffd04c501481418f40d0e060692380f454f58447ea05368a6377e8e0873fa88

                                                                  SHA512

                                                                  e388d4d4234fbfd73677c524f0e4123616bd21eb179103b68e6332d9948c202ff0f58f062464f96c401b35306a072533e48caa8c83868eb13fde3047318f9377

                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\devid.info.url

                                                                  Filesize

                                                                  96B

                                                                  MD5

                                                                  995e05476319ea9d3e4788cd4be7c4d7

                                                                  SHA1

                                                                  728844ebbe6edbd7100fb4111fdd464e1b1588e2

                                                                  SHA256

                                                                  ed04a5d4f98937341704abf7d3f45525ad99cdadc75ad2d9758eb3b8a5cabc25

                                                                  SHA512

                                                                  891f01db8c0e4f8da4eb81fd3419c8caedaf593f9b96cf9cbbccfc11cf88d67b0888a0b70e9b0e93f29e60aa94debb32b9788227abef1fb4307e81a87ace39a9

                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\netamd.inf

                                                                  Filesize

                                                                  25KB

                                                                  MD5

                                                                  69f5462fbb07514b12fbdaded96179a5

                                                                  SHA1

                                                                  a46a12c4925b1fb4950c8b2cbb8642c254817fff

                                                                  SHA256

                                                                  8a94fd96bc4a69686fa04576ee5c886368c5a1870ea6d8212332c96bc00267e3

                                                                  SHA512

                                                                  8b6f7398cabde07035d41973eb75b5a6be7e1c21c36ae2ff034f715e5b7699db93ff4a5bb4456b7a88f95c603d577caa112298cde41fcb5580e92b69a0b07d46

                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\pcntpci5.sys

                                                                  Filesize

                                                                  35KB

                                                                  MD5

                                                                  ccf453c1d9ef8f5720d409df6e5d149e

                                                                  SHA1

                                                                  2c298fd46ebb8eee934b9d6d447feaea9f1e9f12

                                                                  SHA256

                                                                  03b9ee5ce4c4eaefcdb042555594cc2133344f173f0b30068a83563fee5b864e

                                                                  SHA512

                                                                  0f757f7350ae16e3dd8526095b2ea63c6bd5640d99afdc1311d34f62a4011de7768b7b6516da182a6b99c76e7fd706daf980376572f8ffc2e4fe0f907754c29b

                                                                • \Users\Admin\AppData\Local\Temp\129660.devid.info.exe

                                                                  Filesize

                                                                  152KB

                                                                  MD5

                                                                  0464f7cd5a269ce6d73e113ff88e40c2

                                                                  SHA1

                                                                  e3536313e6444849ae348bdeac2b7c7ae0f35c73

                                                                  SHA256

                                                                  0c5309e712ab405e1ea0e5b44ca653df714f5a6f1c009fd5e858d7f6966e1d5a

                                                                  SHA512

                                                                  11fc5b0c14037fe1e337358abe3936ff1d54cbbdcebb443db91caec1ec347cbe8c1254fa17892904979acb633ab067316c412fc225ca26e79018dbeb221f5a06

                                                                • \Users\Admin\AppData\Local\Temp\hh.exe

                                                                  Filesize

                                                                  831KB

                                                                  MD5

                                                                  fbd1bf7fbed25ea9ba00f02dfdd9df86

                                                                  SHA1

                                                                  0d0bdc9132c72ff3de86d32b4659b5a7bb4b613c

                                                                  SHA256

                                                                  171eb2b75643e66deb5cc6b1a7c6f9633e72fafd6012e7a17e1d97f9c2a513d0

                                                                  SHA512

                                                                  5577328bfe7bb521cf3c8e1a9872ef251a42e2c7d5f86fc9c4275edf7ec59295d8f354a1c7568cab588bd63719edd3de12a769fe0423a2a6173c246e780a3834

                                                                • memory/820-189-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/820-162-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/840-611-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/840-589-0x0000000003810000-0x0000000003832000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/908-749-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/908-725-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/920-293-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/920-266-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/944-555-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/952-646-0x00000000036B0000-0x00000000036D2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/952-667-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1032-257-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1032-231-0x00000000036D0000-0x00000000036F2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1096-560-0x00000000038F0000-0x0000000003912000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1096-582-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1128-125-0x00000000036B0000-0x00000000036D2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1128-152-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1272-674-0x00000000037F0000-0x0000000003812000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1272-695-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1276-290-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1396-503-0x00000000036B0000-0x00000000036D2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1396-525-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1492-750-0x0000000003580000-0x00000000035A2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1492-772-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1528-504-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1528-527-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1544-553-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1544-532-0x0000000003570000-0x0000000003592000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1636-751-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1636-746-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1636-724-0x00000000036C0000-0x00000000036E2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1644-299-0x00000000038F0000-0x0000000003912000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1644-326-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1724-697-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1760-391-0x0000000003910000-0x0000000003932000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1760-412-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1764-496-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1848-161-0x00000000036F0000-0x0000000003712000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1848-186-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1864-232-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1864-259-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1928-470-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1928-447-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2008-154-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2148-414-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2160-16-0x00000000031C0000-0x00000000031E2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2160-20-0x0000000000400000-0x000000000050B000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                • memory/2160-2-0x0000000000400000-0x000000000050B000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                • memory/2192-446-0x0000000003570000-0x0000000003592000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2192-468-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2200-669-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2288-384-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2368-613-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2368-590-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2380-197-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2380-584-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2380-561-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2380-224-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2384-618-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2384-641-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2468-419-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2468-222-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2468-441-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2468-196-0x0000000002220000-0x0000000002242000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2528-356-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2552-440-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2560-301-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2560-329-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2576-53-0x00000000036D0000-0x00000000036F2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2576-45-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2576-83-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2668-747-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2728-86-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2804-475-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2804-639-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2804-498-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2808-702-0x0000000003260000-0x0000000003282000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2808-723-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2808-363-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2808-386-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2816-44-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2816-19-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2856-93-0x00000000036B0000-0x00000000036D2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2856-119-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2876-358-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/3056-120-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/3056-94-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                  Filesize

                                                                  136KB