Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...bd.exe

windows7-x64

10

JaffaCakes...bd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    20/03/2025, 12:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_82d21484a9b96ff02e47ad1dfbe8a8bd.exe

  • Size

    916KB

  • MD5

    82d21484a9b96ff02e47ad1dfbe8a8bd

  • SHA1

    7dd052f064c3ee8c6e74f4ac2e3469a41bc927a3

  • SHA256

    5a6d29d55afa18fc6ff4818877f74ab7d5182887a51c6e23b755c552a8d3440d

  • SHA512

    7bb1bdc4780b947612963060c2895c3f7d43ed9e1d37fb47fcc46d625c0ff53c2b7b0c9918b1b0410185575347749059a0031248b3fb85d8a6ec7ceb70908b1d

  • SSDEEP

    24576:9dFJ/ObGa/I0RwV94fCK/cRgOnmq9g6J5/Nd:Xf/i/I0CX4pcOU7m6Jvd

Score
10/10
darkcometguest16discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

os-update.serveftp.com:37751

Mutex

DC_MUTEX-EVGT2S6

Attributes
  • InstallPath

    config\restore\svchost.exe

  • gencode

    F��/Gg#dltm4

  • install

    true

  • offline_keylogger

    true

  • password

    2010R4t1337iHaVeFuN

  • persistence

    true

  • reg_key

    USB Mass-Storage Managment

rc4.plain

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 64 IoCs
    persistence
  • Drops file in Drivers directory 47 IoCs
  • Checks BIOS information in registry 2 TTPs 64 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 43 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Runs ping.exe 1 TTPs 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_82d21484a9b96ff02e47ad1dfbe8a8bd.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_82d21484a9b96ff02e47ad1dfbe8a8bd.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
      "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:580
      • C:\Windows\SysWOW64\config\restore\svchost.exe
        "C:\Windows\system32\config\restore\svchost.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Drops file in Drivers directory
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:1964
        • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
          "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
          4⤵
          • Modifies WinLogon for persistence
          • Drops file in Drivers directory
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Checks processor information in registry
          PID:2708
          • C:\Windows\SysWOW64\config\restore\svchost.exe
            "C:\Windows\system32\config\restore\svchost.exe"
            5⤵
            • Drops file in Drivers directory
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:2472
            • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
              "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Drops file in System32 directory
              • Enumerates system info in registry
              PID:2788
            • C:\Windows\SysWOW64\config\restore\svchost.exe
              "C:\Windows\system32\config\restore\svchost.exe"
              6⤵
              • Checks BIOS information in registry
              • Adds Run key to start application
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:2440
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2872
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 2
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3012
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
            5⤵
              PID:1144
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 2
                6⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2104
          • C:\Windows\SysWOW64\config\restore\svchost.exe
            "C:\Windows\system32\config\restore\svchost.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Drops file in Drivers directory
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:2884
            • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
              "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
              5⤵
              • Modifies WinLogon for persistence
              • Drops file in Drivers directory
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Adds Run key to start application
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:2380
              • C:\Windows\SysWOW64\config\restore\svchost.exe
                "C:\Windows\system32\config\restore\svchost.exe"
                6⤵
                • Drops file in Drivers directory
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                PID:1976
                • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                  "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                  7⤵
                  • Checks BIOS information in registry
                  • Adds Run key to start application
                  • Checks processor information in registry
                  PID:1464
                • C:\Windows\SysWOW64\config\restore\svchost.exe
                  "C:\Windows\system32\config\restore\svchost.exe"
                  7⤵
                  • Modifies WinLogon for persistence
                  • Checks BIOS information in registry
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  PID:1172
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                  7⤵
                    PID:2140
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 2
                      8⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:2616
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:580
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 2
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:1996
              • C:\Windows\SysWOW64\config\restore\svchost.exe
                "C:\Windows\system32\config\restore\svchost.exe"
                5⤵
                • Modifies WinLogon for persistence
                • Drops file in Drivers directory
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:2532
                • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                  "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                  6⤵
                  • Modifies WinLogon for persistence
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  PID:288
                • C:\Windows\SysWOW64\config\restore\svchost.exe
                  "C:\Windows\system32\config\restore\svchost.exe"
                  6⤵
                  • Modifies WinLogon for persistence
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Enumerates system info in registry
                  PID:2296
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                  6⤵
                    PID:2768
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 2
                      7⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:2052
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                  5⤵
                    PID:3068
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 2
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:2268
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1496
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 2
                    5⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:2376
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2296
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 2
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1380
            • C:\Windows\SysWOW64\config\restore\svchost.exe
              "C:\Windows\system32\config\restore\svchost.exe"
              2⤵
              • Modifies WinLogon for persistence
              • Drops file in Drivers directory
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1904
              • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                3⤵
                • Modifies WinLogon for persistence
                • Drops file in Drivers directory
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:2112
                • C:\Windows\SysWOW64\config\restore\svchost.exe
                  "C:\Windows\system32\config\restore\svchost.exe"
                  4⤵
                  • Modifies WinLogon for persistence
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Enumerates system info in registry
                  PID:2544
                  • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                    "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                    5⤵
                    • Modifies WinLogon for persistence
                    • Drops file in Drivers directory
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    PID:2692
                    • C:\Windows\SysWOW64\config\restore\svchost.exe
                      "C:\Windows\system32\config\restore\svchost.exe"
                      6⤵
                      • Modifies WinLogon for persistence
                      • Drops file in Drivers directory
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      PID:1084
                      • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                        "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                        7⤵
                        • Modifies WinLogon for persistence
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:1304
                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                        "C:\Windows\system32\config\restore\svchost.exe"
                        7⤵
                        • Modifies WinLogon for persistence
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        PID:2808
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                        7⤵
                          PID:1952
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 2
                            8⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2996
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:2500
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 2
                          7⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:484
                    • C:\Windows\SysWOW64\config\restore\svchost.exe
                      "C:\Windows\system32\config\restore\svchost.exe"
                      5⤵
                      • Modifies WinLogon for persistence
                      • Drops file in Drivers directory
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:2940
                      • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                        "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                        6⤵
                        • Modifies WinLogon for persistence
                        • Checks BIOS information in registry
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:2004
                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                        "C:\Windows\system32\config\restore\svchost.exe"
                        6⤵
                        • Modifies WinLogon for persistence
                        • Checks BIOS information in registry
                        • System Location Discovery: System Language Discovery
                        • Enumerates system info in registry
                        PID:2976
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:1744
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 2
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:2112
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                      5⤵
                        PID:2548
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 2
                          6⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:1144
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                      4⤵
                        PID:1128
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 2
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:2996
                    • C:\Windows\SysWOW64\config\restore\svchost.exe
                      "C:\Windows\system32\config\restore\svchost.exe"
                      3⤵
                      • Modifies WinLogon for persistence
                      • Drops file in Drivers directory
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:2064
                      • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                        "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                        4⤵
                        • Drops file in Drivers directory
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Enumerates system info in registry
                        • Suspicious use of WriteProcessMemory
                        PID:2268
                        • C:\Windows\SysWOW64\config\restore\svchost.exe
                          "C:\Windows\system32\config\restore\svchost.exe"
                          5⤵
                          • Modifies WinLogon for persistence
                          • Drops file in Drivers directory
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:2472
                          • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                            "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                            6⤵
                            • Modifies WinLogon for persistence
                            • Drops file in Drivers directory
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            PID:2360
                            • C:\Windows\SysWOW64\config\restore\svchost.exe
                              "C:\Windows\system32\config\restore\svchost.exe"
                              7⤵
                              • Modifies WinLogon for persistence
                              • Drops file in Drivers directory
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Drops file in System32 directory
                              • Checks processor information in registry
                              PID:1172
                              • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                8⤵
                                • Modifies WinLogon for persistence
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:2228
                              • C:\Windows\SysWOW64\config\restore\svchost.exe
                                "C:\Windows\system32\config\restore\svchost.exe"
                                8⤵
                                • Modifies WinLogon for persistence
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                PID:1584
                                • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                  "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                  9⤵
                                  • Modifies WinLogon for persistence
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Enumerates system info in registry
                                  PID:2664
                                • C:\Windows\SysWOW64\config\restore\svchost.exe
                                  "C:\Windows\system32\config\restore\svchost.exe"
                                  9⤵
                                  • Modifies WinLogon for persistence
                                  • Drops file in Drivers directory
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:352
                                  • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                    "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                    10⤵
                                    • Modifies WinLogon for persistence
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    PID:1056
                                  • C:\Windows\SysWOW64\config\restore\svchost.exe
                                    "C:\Windows\system32\config\restore\svchost.exe"
                                    10⤵
                                    • Checks BIOS information in registry
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    PID:2240
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                    10⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1016
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1 -n 2
                                      11⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:2052
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                  9⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2584
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping 127.0.0.1 -n 2
                                    10⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:2616
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                8⤵
                                  PID:1812
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping 127.0.0.1 -n 2
                                    9⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:1592
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                7⤵
                                  PID:2628
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping 127.0.0.1 -n 2
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:1288
                              • C:\Windows\SysWOW64\config\restore\svchost.exe
                                "C:\Windows\system32\config\restore\svchost.exe"
                                6⤵
                                • Modifies WinLogon for persistence
                                • Drops file in Drivers directory
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Adds Run key to start application
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:2652
                                • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                  "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                  7⤵
                                  • Modifies WinLogon for persistence
                                  • Drops file in Drivers directory
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Enumerates system info in registry
                                  PID:1688
                                  • C:\Windows\SysWOW64\config\restore\svchost.exe
                                    "C:\Windows\system32\config\restore\svchost.exe"
                                    8⤵
                                    • Drops file in Drivers directory
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Drops file in System32 directory
                                    • Enumerates system info in registry
                                    PID:1340
                                    • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                      "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                      9⤵
                                      • Modifies WinLogon for persistence
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:108
                                    • C:\Windows\SysWOW64\config\restore\svchost.exe
                                      "C:\Windows\system32\config\restore\svchost.exe"
                                      9⤵
                                      • Modifies WinLogon for persistence
                                      • Adds Run key to start application
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:2772
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                      9⤵
                                        PID:2488
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1 -n 2
                                          10⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:2336
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                      8⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2620
                                      • C:\Windows\SysWOW64\PING.EXE
                                        ping 127.0.0.1 -n 2
                                        9⤵
                                        • System Location Discovery: System Language Discovery
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Runs ping.exe
                                        PID:2392
                                  • C:\Windows\SysWOW64\config\restore\svchost.exe
                                    "C:\Windows\system32\config\restore\svchost.exe"
                                    7⤵
                                    • Modifies WinLogon for persistence
                                    • Drops file in Drivers directory
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Drops file in System32 directory
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    PID:536
                                    • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                      "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                      8⤵
                                      • Modifies WinLogon for persistence
                                      • Drops file in Drivers directory
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Drops file in System32 directory
                                      • Enumerates system info in registry
                                      PID:2784
                                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                                        "C:\Windows\system32\config\restore\svchost.exe"
                                        9⤵
                                        • Modifies WinLogon for persistence
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        PID:1760
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                        9⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1088
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1 -n 2
                                          10⤵
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:1288
                                    • C:\Windows\SysWOW64\config\restore\svchost.exe
                                      "C:\Windows\system32\config\restore\svchost.exe"
                                      8⤵
                                      • Modifies WinLogon for persistence
                                      • Drops file in Drivers directory
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Drops file in System32 directory
                                      • Enumerates system info in registry
                                      PID:1672
                                      • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                        "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                        9⤵
                                        • Modifies WinLogon for persistence
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • System Location Discovery: System Language Discovery
                                        • Enumerates system info in registry
                                        PID:1492
                                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                                        "C:\Windows\system32\config\restore\svchost.exe"
                                        9⤵
                                        • Modifies WinLogon for persistence
                                        • Drops file in Drivers directory
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in System32 directory
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        PID:2084
                                        • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                          "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                          10⤵
                                          • Modifies WinLogon for persistence
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Enumerates system info in registry
                                          PID:1868
                                        • C:\Windows\SysWOW64\config\restore\svchost.exe
                                          "C:\Windows\system32\config\restore\svchost.exe"
                                          10⤵
                                          • Modifies WinLogon for persistence
                                          • System Location Discovery: System Language Discovery
                                          • Enumerates system info in registry
                                          PID:2108
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                          10⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1588
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.1 -n 2
                                            11⤵
                                            • System Location Discovery: System Language Discovery
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:2652
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                        9⤵
                                          PID:2820
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.1 -n 2
                                            10⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:2448
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                        8⤵
                                          PID:2616
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.1 -n 2
                                            9⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:284
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2196
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1 -n 2
                                          8⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:1708
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3024
                                      • C:\Windows\SysWOW64\PING.EXE
                                        ping 127.0.0.1 -n 2
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Runs ping.exe
                                        PID:448
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2452
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1 -n 2
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:1996
                                • C:\Windows\SysWOW64\config\restore\svchost.exe
                                  "C:\Windows\system32\config\restore\svchost.exe"
                                  4⤵
                                  • Modifies WinLogon for persistence
                                  • Drops file in Drivers directory
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Enumerates system info in registry
                                  • Suspicious use of WriteProcessMemory
                                  PID:2236
                                  • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                    "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                    5⤵
                                    • Modifies WinLogon for persistence
                                    • Drops file in Drivers directory
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Drops file in System32 directory
                                    • Enumerates system info in registry
                                    PID:852
                                    • C:\Windows\SysWOW64\config\restore\svchost.exe
                                      "C:\Windows\system32\config\restore\svchost.exe"
                                      6⤵
                                      • Drops file in Drivers directory
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:3024
                                      • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                        "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                        7⤵
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Enumerates system info in registry
                                        PID:1948
                                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                                        "C:\Windows\system32\config\restore\svchost.exe"
                                        7⤵
                                        • Modifies WinLogon for persistence
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Enumerates system info in registry
                                        PID:1436
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                        7⤵
                                          PID:3036
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.1 -n 2
                                            8⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:1956
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                        6⤵
                                          PID:1416
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.1 -n 2
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:2316
                                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                                        "C:\Windows\system32\config\restore\svchost.exe"
                                        5⤵
                                        • Modifies WinLogon for persistence
                                        • Drops file in Drivers directory
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        • Drops file in System32 directory
                                        • Checks processor information in registry
                                        PID:2312
                                        • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                          "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                          6⤵
                                          • Modifies WinLogon for persistence
                                          • Drops file in Drivers directory
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Enumerates system info in registry
                                          PID:2912
                                          • C:\Windows\SysWOW64\config\restore\svchost.exe
                                            "C:\Windows\system32\config\restore\svchost.exe"
                                            7⤵
                                            • Modifies WinLogon for persistence
                                            • Drops file in Drivers directory
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • Enumerates system info in registry
                                            PID:1704
                                            • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                              "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                              8⤵
                                              • Modifies WinLogon for persistence
                                              • Drops file in Drivers directory
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Checks processor information in registry
                                              • Enumerates system info in registry
                                              PID:2824
                                              • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                "C:\Windows\system32\config\restore\svchost.exe"
                                                9⤵
                                                • Modifies WinLogon for persistence
                                                • Drops file in Drivers directory
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                PID:1432
                                                • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                  "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                                  10⤵
                                                  • Modifies WinLogon for persistence
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Enumerates system info in registry
                                                  PID:2840
                                                • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                  "C:\Windows\system32\config\restore\svchost.exe"
                                                  10⤵
                                                  • Modifies WinLogon for persistence
                                                  • Checks BIOS information in registry
                                                  • Adds Run key to start application
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Enumerates system info in registry
                                                  PID:3016
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                  10⤵
                                                    PID:2684
                                                    • C:\Windows\SysWOW64\PING.EXE
                                                      ping 127.0.0.1 -n 2
                                                      11⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:1176
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                  9⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2072
                                                  • C:\Windows\SysWOW64\PING.EXE
                                                    ping 127.0.0.1 -n 2
                                                    10⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:2336
                                              • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                "C:\Windows\system32\config\restore\svchost.exe"
                                                8⤵
                                                • Modifies WinLogon for persistence
                                                • Drops file in Drivers directory
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                • Enumerates system info in registry
                                                PID:1464
                                                • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                  "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                                  9⤵
                                                  • Modifies WinLogon for persistence
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  PID:2088
                                                • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                  "C:\Windows\system32\config\restore\svchost.exe"
                                                  9⤵
                                                  • Modifies WinLogon for persistence
                                                  • Drops file in Drivers directory
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Drops file in System32 directory
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  PID:1756
                                                  • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                    "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                                    10⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • System Location Discovery: System Language Discovery
                                                    • Enumerates system info in registry
                                                    PID:1668
                                                  • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                    "C:\Windows\system32\config\restore\svchost.exe"
                                                    10⤵
                                                    • Modifies WinLogon for persistence
                                                    • Checks BIOS information in registry
                                                    • Adds Run key to start application
                                                    • Drops file in System32 directory
                                                    • Enumerates system info in registry
                                                    PID:1904
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 744
                                                    10⤵
                                                    • Program crash
                                                    PID:2452
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                  9⤵
                                                    PID:2676
                                                    • C:\Windows\SysWOW64\PING.EXE
                                                      ping 127.0.0.1 -n 2
                                                      10⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:860
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                  8⤵
                                                    PID:2472
                                                    • C:\Windows\SysWOW64\PING.EXE
                                                      ping 127.0.0.1 -n 2
                                                      9⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:2208
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                  7⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2292
                                                  • C:\Windows\SysWOW64\PING.EXE
                                                    ping 127.0.0.1 -n 2
                                                    8⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:588
                                              • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                "C:\Windows\system32\config\restore\svchost.exe"
                                                6⤵
                                                • Drops file in Drivers directory
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • Enumerates system info in registry
                                                PID:2216
                                                • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                  "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                                  7⤵
                                                  • Modifies WinLogon for persistence
                                                  • Drops file in Drivers directory
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  PID:1884
                                                  • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                    "C:\Windows\system32\config\restore\svchost.exe"
                                                    8⤵
                                                    • Modifies WinLogon for persistence
                                                    • Drops file in Drivers directory
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Drops file in System32 directory
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    PID:808
                                                    • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                      "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                                      9⤵
                                                      • Modifies WinLogon for persistence
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Drops file in System32 directory
                                                      • Checks processor information in registry
                                                      • Enumerates system info in registry
                                                      PID:1864
                                                    • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                      "C:\Windows\system32\config\restore\svchost.exe"
                                                      9⤵
                                                      • Checks BIOS information in registry
                                                      • Drops file in System32 directory
                                                      • Enumerates system info in registry
                                                      PID:1432
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                      9⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2208
                                                      • C:\Windows\SysWOW64\PING.EXE
                                                        ping 127.0.0.1 -n 2
                                                        10⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:448
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                    8⤵
                                                      PID:2032
                                                      • C:\Windows\SysWOW64\PING.EXE
                                                        ping 127.0.0.1 -n 2
                                                        9⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:2336
                                                  • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                    "C:\Windows\system32\config\restore\svchost.exe"
                                                    7⤵
                                                    • Modifies WinLogon for persistence
                                                    • Drops file in Drivers directory
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Adds Run key to start application
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    PID:1852
                                                    • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                      "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                                      8⤵
                                                      • Modifies WinLogon for persistence
                                                      • Drops file in Drivers directory
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Drops file in System32 directory
                                                      • Checks processor information in registry
                                                      • Enumerates system info in registry
                                                      PID:2412
                                                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                        "C:\Windows\system32\config\restore\svchost.exe"
                                                        9⤵
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Checks processor information in registry
                                                        • Enumerates system info in registry
                                                        PID:2320
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                        9⤵
                                                          PID:1420
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping 127.0.0.1 -n 2
                                                            10⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:2068
                                                      • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                        "C:\Windows\system32\config\restore\svchost.exe"
                                                        8⤵
                                                        • Modifies WinLogon for persistence
                                                        • Drops file in Drivers directory
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Drops file in System32 directory
                                                        • Checks processor information in registry
                                                        PID:2560
                                                        • C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                          "C:\Users\Admin\AppData\Local\Temp\WMPLAYER.EXE"
                                                          9⤵
                                                          • Modifies WinLogon for persistence
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Checks processor information in registry
                                                          PID:1880
                                                        • C:\Windows\SysWOW64\config\restore\svchost.exe
                                                          "C:\Windows\system32\config\restore\svchost.exe"
                                                          9⤵
                                                          • Modifies WinLogon for persistence
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • System Location Discovery: System Language Discovery
                                                          • Checks processor information in registry
                                                          • Enumerates system info in registry
                                                          PID:1444
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 740
                                                          9⤵
                                                          • Program crash
                                                          PID:2576
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                        8⤵
                                                          PID:2108
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping 127.0.0.1 -n 2
                                                            9⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:2872
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                        7⤵
                                                          PID:2120
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping 127.0.0.1 -n 2
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:1940
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                        6⤵
                                                          PID:640
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping 127.0.0.1 -n 2
                                                            7⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:1456
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                        5⤵
                                                          PID:1444
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping 127.0.0.1 -n 2
                                                            6⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:2784
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2036
                                                        • C:\Windows\SysWOW64\PING.EXE
                                                          ping 127.0.0.1 -n 2
                                                          5⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:2316
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2280
                                                      • C:\Windows\SysWOW64\PING.EXE
                                                        ping 127.0.0.1 -n 2
                                                        4⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:1124
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
                                                    2⤵
                                                    • Deletes itself
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2364
                                                    • C:\Windows\SysWOW64\PING.EXE
                                                      ping 127.0.0.1 -n 2
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:2204

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat
                                                  Filesize

                                                  81B

                                                  MD5

                                                  16af793c282da98f39b1c26f23c22c34

                                                  SHA1

                                                  175a3eaa35d05554c76582b5a1e38931992b83ac

                                                  SHA256

                                                  b1972633df6d17db76701aa01604514e34a730f0e88df8b17d9edaff19017b5d

                                                  SHA512

                                                  602fd1dc43ca0f123be69002b6cd8fa65d4dbc2643d78f31d2fed2d8946e570cf6ea6dfa8f05e7a8cb4bf0a4653a79475c71b7559539e3dbb29b58f0f69e79ad

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat
                                                  Filesize

                                                  81B

                                                  MD5

                                                  78f856d95103a3d72678e375b074a9ad

                                                  SHA1

                                                  2bcde142a0b3fa62285802aabab14b20bf5e327f

                                                  SHA256

                                                  767349adbd9ed66ee2c1a3792c71d4b9ac4c96e78c1e0ec2b410378a1ebc163c

                                                  SHA512

                                                  c76892e205eabfa6366b561d8b8ac6ee79175eb915aafa0132907402f8c1d35646175dd04cd030f53e59bea1d86f14e3f37d8dd56649b826d7bbd6372e3c20dc

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat
                                                  Filesize

                                                  119B

                                                  MD5

                                                  16f6e52a697e14d5a319adebcf0ad387

                                                  SHA1

                                                  ba0558de3fc67685d68217b46a2c6dab5f9e1b34

                                                  SHA256

                                                  61c3e2fd6a74187f2ce826250371358c007538f4f02cd3f4dd9df13d9acd10cf

                                                  SHA512

                                                  3b033aea52c70c8a2438d949504093b84fa9ce25429062a51425e0dccab84c20fd53ffe44d4519f5e2c4261da7fa782e51669f9d10da4a5b034024d81ddfdb00

                                                  Download Submit

                                                • C:\Windows\system32\drivers\etc\hosts
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  c38e4bf2e91f81dae592bf448f7edd4d

                                                  SHA1

                                                  99498d591cf07c7bdb5ef73de26908971b631e3a

                                                  SHA256

                                                  5853685d91bdb35df83ad794fdebc4a3c9c950f6a5f5e8b09083926b8e121c47

                                                  SHA512

                                                  726292ede31620089f05d19537577a8bb5517cdcb7c207a1e146455ef5ff44bbeacdb56af5b8615b15c2b75cb1522695ce8397ec9eb76db7b69c850881efcf96

                                                  Download Submit

                                                • C:\Windows\system32\drivers\etc\hosts
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  5261d5357c04ed292691069fc46a5bd4

                                                  SHA1

                                                  b51d31898ceee1cf83a962356bee57ddf1232503

                                                  SHA256

                                                  247a8fd3bcab239ecfce3ce84975ad6b501a426f0cd2acd75937fb7be00bb689

                                                  SHA512

                                                  ba9de6fefabd97b406a96df18c6b1c3be435f29c495544417c8447b5cc477b47374334431fce5b50e372b6b7d88e56bed1165bbbf911a4ec1cfacb576eeecfa1

                                                  Download Submit

                                                • C:\Windows\system32\drivers\etc\hosts
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  ee99645831b02923239dead892421f58

                                                  SHA1

                                                  9cb112b5de42fe28581087dd3229bfcb284ce377

                                                  SHA256

                                                  918b19a5ecd2b5ec61877e2c64c0f1da6cc9e7f324dd70abf2a2707228ada4c1

                                                  SHA512

                                                  878f3a449eea8c7929f507eb9fcff97d69ea90e606c32bc5eb9da597e6206e325238f9c366eec813b6562aa62d79b862ba478a3f85bcde92ba24cba023110dc4

                                                  Download Submit

                                                • C:\Windows\system32\drivers\etc\hosts
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  b3cbc1d4218a696814a8c1271501fd81

                                                  SHA1

                                                  b445230841f17a8d2092b1c873d161f590f2cd93

                                                  SHA256

                                                  d7b9d956313e10b4a271a78cfce3503376bb5bee49d1a3289e02a60d8437a4d4

                                                  SHA512

                                                  463d99a944061ff12c7343cde71bd7676c55926c736f695c25fc4c62a13aabd0c74d16957e54b5faa25d3e4b14b9b59dd4f783996c89bbef344252c10e1f1319

                                                  Download Submit

                                                • C:\Windows\system32\drivers\etc\hosts
                                                  Filesize

                                                  1019B

                                                  MD5

                                                  b17b59d62ffcd04ba9453b852c3ec33f

                                                  SHA1

                                                  ba0ce0dbb9ea085a083069deb120211108a78fe4

                                                  SHA256

                                                  7e4882ab62514da96de18485b9de7490b427b4320381829f4a2b1333d7a8ccf4

                                                  SHA512

                                                  23f08ab3d5c9a89741f8cf664bfc11ec9d9d9cd689508dab41781eb4e7cdcd9e5da269c7a53eb8cb97f9e50ca525961d77616180a7b2e19472c52f89b72cd9f2

                                                  Download Submit

                                                • \Users\Admin\AppData\Local\Temp\WMPLAYER.EXE
                                                  Filesize

                                                  715KB

                                                  MD5

                                                  97abfefbeb481b79bad96b34af93a386

                                                  SHA1

                                                  236f09658d01da2c07d64408412c1d27295ee74d

                                                  SHA256

                                                  59e319b1ac09265709772f56ea6c2819f264dc1e6b2bdfb45a0fb59296af732a

                                                  SHA512

                                                  571d536e58c247fee7dd5e1c0422ffbda5d8e9aeee000b7a97576da14a9376de3705ad2c99115b075291bc74f412b03ad34649721839bceaa251e0ef420a2323

                                                  Download Submit

                                                • \Windows\SysWOW64\config\restore\svchost.exe
                                                  Filesize

                                                  916KB

                                                  MD5

                                                  82d21484a9b96ff02e47ad1dfbe8a8bd

                                                  SHA1

                                                  7dd052f064c3ee8c6e74f4ac2e3469a41bc927a3

                                                  SHA256

                                                  5a6d29d55afa18fc6ff4818877f74ab7d5182887a51c6e23b755c552a8d3440d

                                                  SHA512

                                                  7bb1bdc4780b947612963060c2895c3f7d43ed9e1d37fb47fcc46d625c0ff53c2b7b0c9918b1b0410185575347749059a0031248b3fb85d8a6ec7ceb70908b1d

                                                  Download Submit

                                                • memory/352-523-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/536-310-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/536-281-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/536-255-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/580-110-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/580-166-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/808-544-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/852-328-0x0000000004790000-0x0000000004958000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/852-329-0x0000000004790000-0x0000000004958000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/852-330-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/852-232-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1084-532-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1172-360-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1340-543-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1432-514-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1436-504-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1444-505-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1492-503-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1584-442-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1672-311-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1672-371-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1688-408-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1688-341-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1704-309-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1704-289-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1756-542-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1852-325-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1852-279-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1880-501-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1884-409-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1884-342-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1904-108-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1904-103-0x0000000007390000-0x0000000007558000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/1948-489-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/1964-213-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2064-106-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2064-126-0x00000000073A0000-0x0000000007568000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2064-128-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2084-541-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2088-502-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2112-268-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2112-228-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2112-131-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2216-277-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2216-227-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2216-278-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2216-269-0x0000000007450000-0x0000000007618000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2228-500-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2236-184-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2236-182-0x0000000005FA0000-0x0000000006168000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2236-167-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2236-174-0x0000000005FA0000-0x0000000006168000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2268-153-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2312-185-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2312-226-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2360-288-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2360-339-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2380-420-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2380-340-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2412-421-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2412-451-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2472-214-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2472-154-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2472-187-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2532-370-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2532-290-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2532-254-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2544-326-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2544-280-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2560-433-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2652-243-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2652-216-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2692-488-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2692-424-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2708-418-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2708-287-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2732-21-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-38-0x0000000002570000-0x0000000002571000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-47-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-49-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-50-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-45-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-1-0x00000000005D0000-0x0000000000630000-memory.dmp

                                                  Filesize

                                                  384KB

                                                  Download

                                                • memory/2732-48-0x0000000003780000-0x0000000003783000-memory.dmp

                                                  Filesize

                                                  12KB

                                                  Download

                                                • memory/2732-39-0x00000000005D0000-0x0000000000630000-memory.dmp

                                                  Filesize

                                                  384KB

                                                  Download

                                                • memory/2732-5-0x0000000000280000-0x0000000000281000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-9-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-8-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-40-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-7-0x0000000000380000-0x0000000000381000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-41-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-42-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-43-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-44-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-23-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2732-24-0x0000000000640000-0x0000000000641000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-25-0x0000000000630000-0x0000000000631000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-26-0x0000000000690000-0x0000000000691000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-52-0x0000000000270000-0x0000000000271000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-27-0x0000000000660000-0x0000000000661000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-28-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-29-0x00000000006A0000-0x00000000006A1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-30-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-31-0x0000000000710000-0x0000000000711000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-32-0x0000000000700000-0x0000000000701000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-0-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2732-33-0x0000000002580000-0x0000000002581000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-34-0x0000000002550000-0x0000000002551000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-36-0x0000000000650000-0x0000000000651000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-46-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-37-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-35-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-14-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-16-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-17-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-18-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-51-0x0000000000250000-0x0000000000251000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-19-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-3-0x0000000000290000-0x0000000000291000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-75-0x00000000074B0000-0x0000000007678000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2732-2-0x00000000002E0000-0x00000000002E1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-20-0x0000000003780000-0x0000000003781000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-85-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2732-77-0x00000000074B0000-0x0000000007678000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2732-11-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-22-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-10-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-12-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-86-0x00000000005D0000-0x0000000000630000-memory.dmp

                                                  Filesize

                                                  384KB

                                                  Download

                                                • memory/2732-15-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2732-13-0x0000000003790000-0x0000000003791000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2784-468-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2784-423-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2824-479-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2824-422-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2884-215-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2884-253-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2912-257-0x0000000000400000-0x00000000004C1000-memory.dmp

                                                  Filesize

                                                  772KB

                                                  Download

                                                • memory/2912-258-0x0000000005FD0000-0x0000000006198000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2912-256-0x0000000005FD0000-0x0000000006198000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2940-432-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/2940-327-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/3024-369-0x0000000000400000-0x00000000005C8000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download