netwire | a11a2b4877664bfacaa49ce46f161af9e03c0a044832260da0c6977c610cbaae

Target

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe
Size

1.1MB
MD5

aa4c23269c9b3026cf16225badbf7d5f
SHA1

78247b69edd8cf0bdc064fcae5ab31470c62ab3a
SHA256

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e
SHA512

c9d6716616ddd6cd2ccf4679af1fbd2dff587f89ba89745c122d82fa8aabd6762a59534ad002c4ea5ddc9373328fbae7588f9d4b071f1083ce91915a73f7ab3c

Score

10^/10

netwire wshrat botnet rat stealer trojan upx

Malware Config

Extracted

Family

netwire

donphilongz.org:5005

Attributes

activex_autorun
false
activex_key
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
uTGwFNvi
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3540-133-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral2/memory/3840-210-0x0000000000500000-0x00000000005AE000-memory.dmp	netwire
behavioral2/memory/2296-267-0x0000000000500000-0x000000000064A000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Executes dropped EXE 8 IoCs

Processes:

syststemfile.exesystemfiles.exesystemefile.exesystemstability.exesystemefile.exesystemefile.exesystemstability.exesystemstability.exe

pid	process
1684	syststemfile.exe
2528	systemfiles.exe
1624	systemefile.exe
3712	systemstability.exe
3540	systemefile.exe
184	systemefile.exe
1320	systemstability.exe
2652	systemstability.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1320-142-0x0000000000400000-0x000000000047F000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

notepad.exenotepad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemstability.vbs	notepad.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com

flow	ioc
14	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

systemefile.exesystemstability.exe

description	pid	process	target process
PID 1624 set thread context of 3540	1624	systemefile.exe	systemefile.exe
PID 3712 set thread context of 1320	3712	systemstability.exe	systemstability.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe

NTFS ADS 2 IoCs

Processes:

notepad.exenotepad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe:ZoneIdentifier	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe:ZoneIdentifier	notepad.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	18	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 23/6/2021\|JavaScript-v1.6

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

syststemfile.exesystemfiles.exesystemefile.exesystemstability.exesystemefile.exesystemstability.exe

pid	process
1684	syststemfile.exe
1684	syststemfile.exe
2528	systemfiles.exe
2528	systemfiles.exe
1624	systemefile.exe
1624	systemefile.exe
3712	systemstability.exe
3712	systemstability.exe
184	systemefile.exe
184	systemefile.exe
184	systemefile.exe
184	systemefile.exe
184	systemefile.exe
184	systemefile.exe
2652	systemstability.exe
2652	systemstability.exe
2652	systemstability.exe
2652	systemstability.exe
184	systemefile.exe
184	systemefile.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

systemefile.exesystemstability.exe

pid process

1624 systemefile.exe
3712 systemstability.exe

pid	process
1624	systemefile.exe
3712	systemstability.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exesyststemfile.exesystemfiles.exenotepad.exenotepad.exesystemefile.exesystemstability.exesystemefile.exe

description	pid	process	target process
PID 4020 wrote to memory of 1684	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	syststemfile.exe
PID 4020 wrote to memory of 1684	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	syststemfile.exe
PID 4020 wrote to memory of 1684	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	syststemfile.exe
PID 1684 wrote to memory of 2384	1684	syststemfile.exe	notepad.exe
PID 1684 wrote to memory of 2384	1684	syststemfile.exe	notepad.exe
PID 1684 wrote to memory of 2384	1684	syststemfile.exe	notepad.exe
PID 1684 wrote to memory of 2384	1684	syststemfile.exe	notepad.exe
PID 1684 wrote to memory of 2384	1684	syststemfile.exe	notepad.exe
PID 4020 wrote to memory of 2528	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	systemfiles.exe
PID 4020 wrote to memory of 2528	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	systemfiles.exe
PID 4020 wrote to memory of 2528	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	systemfiles.exe
PID 2528 wrote to memory of 2704	2528	systemfiles.exe	notepad.exe
PID 2528 wrote to memory of 2704	2528	systemfiles.exe	notepad.exe
PID 2528 wrote to memory of 2704	2528	systemfiles.exe	notepad.exe
PID 2528 wrote to memory of 2704	2528	systemfiles.exe	notepad.exe
PID 2528 wrote to memory of 2704	2528	systemfiles.exe	notepad.exe
PID 2384 wrote to memory of 1624	2384	notepad.exe	systemefile.exe
PID 2384 wrote to memory of 1624	2384	notepad.exe	systemefile.exe
PID 2384 wrote to memory of 1624	2384	notepad.exe	systemefile.exe
PID 4020 wrote to memory of 2600	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	WScript.exe
PID 4020 wrote to memory of 2600	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	WScript.exe
PID 4020 wrote to memory of 2600	4020	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	WScript.exe
PID 2704 wrote to memory of 3712	2704	notepad.exe	systemstability.exe
PID 2704 wrote to memory of 3712	2704	notepad.exe	systemstability.exe
PID 2704 wrote to memory of 3712	2704	notepad.exe	systemstability.exe
PID 1624 wrote to memory of 3540	1624	systemefile.exe	systemefile.exe
PID 1624 wrote to memory of 3540	1624	systemefile.exe	systemefile.exe
PID 1624 wrote to memory of 3540	1624	systemefile.exe	systemefile.exe
PID 1624 wrote to memory of 184	1624	systemefile.exe	systemefile.exe
PID 1624 wrote to memory of 184	1624	systemefile.exe	systemefile.exe
PID 1624 wrote to memory of 184	1624	systemefile.exe	systemefile.exe
PID 3712 wrote to memory of 1320	3712	systemstability.exe	systemstability.exe
PID 3712 wrote to memory of 1320	3712	systemstability.exe	systemstability.exe
PID 3712 wrote to memory of 1320	3712	systemstability.exe	systemstability.exe
PID 3712 wrote to memory of 2652	3712	systemstability.exe	systemstability.exe
PID 3712 wrote to memory of 2652	3712	systemstability.exe	systemstability.exe
PID 3712 wrote to memory of 2652	3712	systemstability.exe	systemstability.exe
PID 3540 wrote to memory of 2092	3540	systemefile.exe	Host.exe
PID 3540 wrote to memory of 2092	3540	systemefile.exe	Host.exe
PID 3540 wrote to memory of 2092	3540	systemefile.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe
"C:\Users\Admin\AppData\Local\Temp\9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4020

C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
6⤵
PID:2092

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
7⤵
PID:1040

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:2516

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:3100

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3100 259271000
9⤵
PID:3760

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:2296

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:1684

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1684 259271593
11⤵
PID:3840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:3820

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:1040

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1040 259272312
13⤵
PID:2516

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:3728

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:1040

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
16⤵
PID:2172

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
17⤵
PID:2960

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:212

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:1040

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:2960

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1684 259275203
18⤵
PID:212

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:2964

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
20⤵
PID:2960

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
21⤵
PID:1684

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2960 259275640
20⤵
PID:4076

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
21⤵
PID:1040

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
22⤵
PID:3576

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3576 259276875
22⤵
PID:2504

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
23⤵
PID:3872

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
24⤵
PID:3912

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3912 259277187
24⤵
PID:2544

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1040 259274843
19⤵
PID:2172

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1040 259273859
15⤵
PID:2296

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
16⤵
PID:2964

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:3964

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3964 259274593
17⤵
PID:812

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:3676

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:1264

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1264 259274937
19⤵
PID:3840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
20⤵
PID:2548

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2528 259275406
21⤵
PID:2532

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
22⤵
PID:3912

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
23⤵
PID:2632

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2632 259276609
23⤵
PID:3840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
24⤵
- Suspicious behavior: EnumeratesProcesses
PID:184

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
25⤵
PID:2528

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2528 259277218
25⤵
PID:1976

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
26⤵
PID:1264

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
27⤵
PID:3804

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
28⤵
PID:2604

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
29⤵
PID:204

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
30⤵
PID:812

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
31⤵
PID:3820

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3820 259277890
31⤵
PID:1296

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3804 259277468
27⤵
PID:2960

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
28⤵
PID:3736

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
29⤵
PID:212

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
30⤵
PID:2176

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
31⤵
PID:4140

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
32⤵
PID:4244

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 212 259277734
29⤵
PID:3804

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
30⤵
PID:4132

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
31⤵
PID:4168

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
32⤵
PID:4256

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4168 259278031
31⤵
PID:4176

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
21⤵
PID:2528

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3540 259269312
5⤵
- Executes dropped EXE
PID:184

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:1296

C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2704

C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3712

C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe" 2 1320 259269546
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2652

C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe"
5⤵
- Executes dropped EXE
PID:1320

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles878.js"
2⤵
PID:2600

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js"
3⤵
PID:2212

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\systemfiles878.js"
3⤵
PID:2088

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js"
4⤵
PID:2176

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3300 259270671
1⤵
PID:2132

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:3300

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:2600

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:3564

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
PID:1492

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
4⤵
PID:2176

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:2548

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3256 259277890
6⤵
PID:2964

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:3256

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3564 259277453
2⤵
PID:192

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
PID:2964

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:2172

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2172 259277734
4⤵
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles878.js
MD5
327faf02e528e6e356fc2e92fd8c1d3e

SHA1
550f1188d669145900135c0300630deebcfadf23

SHA256
03849d530ff832cdb13c5d8dd62772575f3f6c56c7cccf5ecd333d5ea27e6efb

SHA512
a23ee3b5fd140fea5b025676b2bebe9e1efb7ac8b836c83d57e3695a185c3dc676cfd444acd34116239679515fa45de3a5cd639eb5c3991d880d323a1ad56281

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\systemfiles878.js
MD5
327faf02e528e6e356fc2e92fd8c1d3e

SHA1
550f1188d669145900135c0300630deebcfadf23

SHA256
03849d530ff832cdb13c5d8dd62772575f3f6c56c7cccf5ecd333d5ea27e6efb

SHA512
a23ee3b5fd140fea5b025676b2bebe9e1efb7ac8b836c83d57e3695a185c3dc676cfd444acd34116239679515fa45de3a5cd639eb5c3991d880d323a1ad56281

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles.vbs
MD5
6b17a5baf42e2eced60b40326f06d539

SHA1
7e9f1a9d9f83e89cea6eb1442c2a70dfaa9d94a3

SHA256
4dcd87ba10ee62cea3f021b7d91ed36240e9c64d3218bfaf942e1677695cc411

SHA512
13a02f02088552997c07545fae4d2f0f35490398cc5e46e662c4041bdd905cd65b2e00dd957e369f31d6e020d38978ed3ca9525529c0782badf742a6b00ea651

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles878.js
MD5
327faf02e528e6e356fc2e92fd8c1d3e

SHA1
550f1188d669145900135c0300630deebcfadf23

SHA256
03849d530ff832cdb13c5d8dd62772575f3f6c56c7cccf5ecd333d5ea27e6efb

SHA512
a23ee3b5fd140fea5b025676b2bebe9e1efb7ac8b836c83d57e3695a185c3dc676cfd444acd34116239679515fa45de3a5cd639eb5c3991d880d323a1ad56281

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js
MD5
45f5c927b03df5996b42c0eab0e0f7c7

SHA1
a6e990d3c7bc1e94a1c8fd96674ba818f7e0b83e

SHA256
4fe7a0c1b20ae55003849f7de12b0756434b956676d02fbff06daa9c8d85b0f5

SHA512
4716fc8e7485698d9c4c6c6a52c64fef13e737a935ed4d9fb84e31c1e3a403d6f21cfc64f4910e7bbd38275ecafa15a456044ab68f3471d722585decf04077e9

Download Submit
C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js
MD5
45f5c927b03df5996b42c0eab0e0f7c7

SHA1
a6e990d3c7bc1e94a1c8fd96674ba818f7e0b83e

SHA256
4fe7a0c1b20ae55003849f7de12b0756434b956676d02fbff06daa9c8d85b0f5

SHA512
4716fc8e7485698d9c4c6c6a52c64fef13e737a935ed4d9fb84e31c1e3a403d6f21cfc64f4910e7bbd38275ecafa15a456044ab68f3471d722585decf04077e9

Download Submit
memory/184-141-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/184-300-0x0000000000000000-mapping.dmp

Download
memory/184-138-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/184-132-0x0000000000000000-mapping.dmp

Download
memory/212-271-0x0000000000000000-mapping.dmp

Download
memory/212-250-0x0000000000000000-mapping.dmp

Download
memory/812-246-0x0000000000000000-mapping.dmp

Download
memory/1040-218-0x000000000040242D-mapping.dmp

Download
memory/1040-232-0x000000000040242D-mapping.dmp

Download
memory/1040-157-0x0000000000000000-mapping.dmp

Download
memory/1040-253-0x000000000040242D-mapping.dmp

Download
memory/1040-289-0x0000000000000000-mapping.dmp

Download
memory/1264-259-0x000000000040242D-mapping.dmp

Download
memory/1296-168-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/1296-174-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1296-159-0x0000000000000000-mapping.dmp

Download
memory/1320-151-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/1320-137-0x000000000047D4A0-mapping.dmp

Download
memory/1320-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-203-0x0000000000580000-0x000000000062E000-memory.dmp

Filesize
696KB

Download
memory/1624-205-0x0000000000580000-0x000000000062E000-memory.dmp

Filesize
696KB

Download
memory/1624-122-0x0000000000000000-mapping.dmp

Download
memory/1624-206-0x0000000000580000-0x000000000062E000-memory.dmp

Filesize
696KB

Download
memory/1684-146-0x0000000000650000-0x000000000079A000-memory.dmp

Filesize
1.3MB

Download
memory/1684-144-0x0000000000650000-0x000000000079A000-memory.dmp

Filesize
1.3MB

Download
memory/1684-114-0x0000000000000000-mapping.dmp

Download
memory/1684-130-0x0000000000650000-0x000000000079A000-memory.dmp

Filesize
1.3MB

Download
memory/1684-268-0x000000000040242D-mapping.dmp

Download
memory/1684-197-0x000000000040242D-mapping.dmp

Download
memory/1976-304-0x0000000000000000-mapping.dmp

Download
memory/2088-170-0x0000000000000000-mapping.dmp

Download
memory/2092-156-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/2092-160-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2092-150-0x0000000000000000-mapping.dmp

Download
memory/2132-195-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2132-173-0x0000000000000000-mapping.dmp

Download
memory/2132-186-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2172-256-0x0000000000000000-mapping.dmp

Download
memory/2172-240-0x0000000000000000-mapping.dmp

Download
memory/2176-217-0x0000000000000000-mapping.dmp

Download
memory/2212-163-0x0000000000000000-mapping.dmp

Download
memory/2296-267-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/2296-234-0x0000000000000000-mapping.dmp

Download
memory/2296-196-0x0000000000650000-0x000000000079A000-memory.dmp

Filesize
1.3MB

Download
memory/2296-200-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/2296-191-0x0000000000000000-mapping.dmp

Download
memory/2384-154-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/2384-117-0x0000000000000000-mapping.dmp

Download
memory/2504-296-0x0000000000000000-mapping.dmp

Download
memory/2516-179-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2516-182-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2516-165-0x0000000000000000-mapping.dmp

Download
memory/2516-239-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2516-220-0x0000000000000000-mapping.dmp

Download
memory/2516-231-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2528-302-0x000000000040242D-mapping.dmp

Download
memory/2528-118-0x0000000000000000-mapping.dmp

Download
memory/2528-166-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/2528-155-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/2528-164-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/2528-276-0x000000000040242D-mapping.dmp

Download
memory/2532-277-0x0000000000000000-mapping.dmp

Download
memory/2544-303-0x0000000000000000-mapping.dmp

Download
memory/2548-273-0x0000000000580000-0x00000000006CA000-memory.dmp

Filesize
1.3MB

Download
memory/2548-265-0x0000000000000000-mapping.dmp

Download
memory/2600-305-0x0000000000000000-mapping.dmp

Download
memory/2600-125-0x0000000000000000-mapping.dmp

Download
memory/2632-288-0x000000000040242D-mapping.dmp

Download
memory/2652-139-0x0000000000000000-mapping.dmp

Download
memory/2652-147-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2652-149-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/2704-121-0x0000000000000000-mapping.dmp

Download
memory/2960-263-0x0000000000000000-mapping.dmp

Download
memory/2960-243-0x0000000000000000-mapping.dmp

Download
memory/2960-283-0x000000000040242D-mapping.dmp

Download
memory/2964-242-0x0000000000000000-mapping.dmp

Download
memory/2964-280-0x0000000000000000-mapping.dmp

Download
memory/3100-181-0x000000000040242D-mapping.dmp

Download
memory/3300-172-0x000000000040242D-mapping.dmp

Download
memory/3540-127-0x000000000040242D-mapping.dmp

Download
memory/3540-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3576-294-0x000000000040242D-mapping.dmp

Download
memory/3676-252-0x0000000000000000-mapping.dmp

Download
memory/3712-136-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/3712-135-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3712-207-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/3712-126-0x0000000000000000-mapping.dmp

Download
memory/3728-235-0x00000000005A0000-0x000000000064E000-memory.dmp

Filesize
696KB

Download
memory/3728-230-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/3728-224-0x0000000000000000-mapping.dmp

Download
memory/3728-233-0x00000000005A0000-0x000000000064E000-memory.dmp

Filesize
696KB

Download
memory/3760-183-0x0000000000000000-mapping.dmp

Download
memory/3760-190-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/3760-194-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3820-211-0x0000000000000000-mapping.dmp

Download
memory/3820-228-0x0000000000640000-0x000000000078A000-memory.dmp

Filesize
1.3MB

Download
memory/3820-226-0x0000000000640000-0x000000000078A000-memory.dmp

Filesize
1.3MB

Download
memory/3820-223-0x0000000000640000-0x000000000078A000-memory.dmp

Filesize
1.3MB

Download
memory/3840-291-0x0000000000000000-mapping.dmp

Download
memory/3840-212-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/3840-201-0x0000000000000000-mapping.dmp

Download
memory/3840-260-0x0000000000000000-mapping.dmp

Download
memory/3840-210-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/3840-213-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/3872-299-0x0000000000000000-mapping.dmp

Download
memory/3912-282-0x0000000000000000-mapping.dmp

Download
memory/3912-301-0x000000000040242D-mapping.dmp

Download
memory/3964-245-0x000000000040242D-mapping.dmp

Download
memory/4076-285-0x0000000000000000-mapping.dmp

Download