nanocore | a11a2b4877664bfacaa49ce46f161af9e03c0a044832260da0c6977c610cbaae

Analysis

max time kernel
26s
max time network
36s
platform
windows10_x64
resource
win10v20210408
submitted
23-06-2021 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe
Size

1.1MB
MD5

aa4c23269c9b3026cf16225badbf7d5f
SHA1

78247b69edd8cf0bdc064fcae5ab31470c62ab3a
SHA256

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e
SHA512

c9d6716616ddd6cd2ccf4679af1fbd2dff587f89ba89745c122d82fa8aabd6762a59534ad002c4ea5ddc9373328fbae7588f9d4b071f1083ce91915a73f7ab3c

Score

10^/10

nanocore netwire wshrat botnet evasion keylogger persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

netwire

donphilongz.org:5005

Attributes

activex_autorun
false
activex_key
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
uTGwFNvi
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4084-156-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral2/memory/2724-213-0x0000000000640000-0x000000000078A000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Executes dropped EXE 34 IoCs

Processes:

syststemfile.exesystemfiles.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemstability.exesystemstability.exeHost.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exeHost.exesystemefile.exenotepad.exesystemefile.exesystemefile.exeHost.exesystemefile.exesystemefile.exesystemefile.exenotepad.exe

pid	process
2360	syststemfile.exe
4020	systemfiles.exe
4056	systemefile.exe
4084	systemefile.exe
2308	systemefile.exe
2976	systemefile.exe
3940	systemstability.exe
8	systemstability.exe
3508	Host.exe
4044	systemefile.exe
2128	systemefile.exe
2736	systemefile.exe
2308	systemefile.exe
2016	systemefile.exe
3836	systemefile.exe
184	systemefile.exe
3044	systemefile.exe
1848	systemefile.exe
2724	systemefile.exe
1540	systemefile.exe
2844	Host.exe
1848	systemefile.exe
2836	systemefile.exe
192	notepad.exe
1352	systemefile.exe
184	systemefile.exe
2840	systemefile.exe
2600	Host.exe
1540	systemefile.exe
2304	systemefile.exe
1588	systemefile.exe
2192	systemefile.exe
3064	notepad.exe
1848	systemefile.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3940-141-0x0000000000400000-0x000000000047F000-memory.dmp	upx

Drops startup file 7 IoCs

Processes:

systemefile.exewscript.exewscript.exesystemefile.exenotepad.exenotepad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles878.js	systemefile.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfQEWRrrdw.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfQEWRrrdw.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles878.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles.vbs	systemefile.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemstability.vbs	notepad.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

systemefile.exewscript.exewscript.exesystemefile.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\appdata\\systemefile.exe"	systemefile.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\lfQEWRrrdw = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\lfQEWRrrdw.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lfQEWRrrdw = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\lfQEWRrrdw.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\systemfiles878 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\systemfiles878.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	systemefile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\systemfiles878 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\systemfiles878.js\""	systemefile.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\systemfiles878 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\systemfiles878.js\""	systemefile.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	systemefile.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\systemfiles878 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\systemfiles878.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run	systemefile.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

systemstability.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA systemstability.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 ip-api.com

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	systemstability.exe

flow	ioc
16	ip-api.com

Suspicious use of SetThreadContext 10 IoCs

Processes:

systemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exe

description	pid	process	target process
PID 4056 set thread context of 4084	4056	systemefile.exe	systemefile.exe
PID 2308 set thread context of 3940	2308	systemefile.exe	systemstability.exe
PID 4044 set thread context of 2128	4044	systemefile.exe	systemefile.exe
PID 2736 set thread context of 2016	2736	systemefile.exe	systemefile.exe
PID 184 set thread context of 3044	184	systemefile.exe	systemefile.exe
PID 2724 set thread context of 1540	2724	systemefile.exe	systemefile.exe
PID 1848 set thread context of 2836	1848	systemefile.exe	systemefile.exe
PID 1352 set thread context of 184	1352	systemefile.exe	systemefile.exe
PID 1540 set thread context of 2304	1540	systemefile.exe	systemefile.exe
PID 2192 set thread context of 3064	2192	systemefile.exe	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe

NTFS ADS 4 IoCs

Processes:

notepad.exenotepad.exesystemefile.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe:ZoneIdentifier	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe:ZoneIdentifier	notepad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe:ZoneIdentifier	notepad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe:ZoneIdentifier	systemefile.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	26	WSHRAT\|3ED10BF6\|GFBFPSXA\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 23/6/2021\|JavaScript-v1.6
HTTP User-Agent header	30	WSHRAT\|3ED10BF6\|GFBFPSXA\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 23/6/2021\|JavaScript-v1.6
HTTP User-Agent header	18	WSHRAT\|3ED10BF6\|GFBFPSXA\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 23/6/2021\|JavaScript-v1.6

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

syststemfile.exesystemfiles.exesystemefile.exesystemefile.exesystemefile.exesystemstability.exeHost.exesystemefile.exesystemstability.exesystemefile.exe

pid	process
2360	syststemfile.exe
2360	syststemfile.exe
4020	systemfiles.exe
4020	systemfiles.exe
4056	systemefile.exe
4056	systemefile.exe
2308	systemefile.exe
2308	systemefile.exe
2976	systemefile.exe
2976	systemefile.exe
2976	systemefile.exe
2976	systemefile.exe
2976	systemefile.exe
2976	systemefile.exe
2976	systemefile.exe
2976	systemefile.exe
8	systemstability.exe
8	systemstability.exe
8	systemstability.exe
8	systemstability.exe
2976	systemefile.exe
2976	systemefile.exe
8	systemstability.exe
8	systemstability.exe
2976	systemefile.exe
2976	systemefile.exe
8	systemstability.exe
8	systemstability.exe
2976	systemefile.exe
2976	systemefile.exe
8	systemstability.exe
8	systemstability.exe
2976	systemefile.exe
2976	systemefile.exe
8	systemstability.exe
8	systemstability.exe
2976	systemefile.exe
2976	systemefile.exe
8	systemstability.exe
8	systemstability.exe
3508	Host.exe
3508	Host.exe
2976	systemefile.exe
2976	systemefile.exe
8	systemstability.exe
8	systemstability.exe
8	systemstability.exe
8	systemstability.exe
4044	systemefile.exe
4044	systemefile.exe
8	systemstability.exe
8	systemstability.exe
8	systemstability.exe
8	systemstability.exe
3940	systemstability.exe
3940	systemstability.exe
3940	systemstability.exe
2736	systemefile.exe
2736	systemefile.exe
2308	systemefile.exe
2308	systemefile.exe
2308	systemefile.exe
2308	systemefile.exe
8	systemstability.exe

Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

systemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exe

pid	process
4056	systemefile.exe
2308	systemefile.exe
4044	systemefile.exe
2736	systemefile.exe
184	systemefile.exe
2724	systemefile.exe
1848	systemefile.exe
1352	systemefile.exe
1540	systemefile.exe
2192	systemefile.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

systemstability.exe

description pid process

Token: SeDebugPrivilege 3940 systemstability.exe

description	pid	process
Token: SeDebugPrivilege	3940	systemstability.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exesyststemfile.exesystemfiles.exenotepad.exesystemefile.exenotepad.exesystemefile.exesystemefile.exeHost.exesystemefile.exesystemefile.exesystemefile.exesystemefile.exe

description	pid	process	target process
PID 776 wrote to memory of 2360	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	syststemfile.exe
PID 776 wrote to memory of 2360	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	syststemfile.exe
PID 776 wrote to memory of 2360	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	syststemfile.exe
PID 2360 wrote to memory of 3544	2360	syststemfile.exe	notepad.exe
PID 2360 wrote to memory of 3544	2360	syststemfile.exe	notepad.exe
PID 2360 wrote to memory of 3544	2360	syststemfile.exe	notepad.exe
PID 2360 wrote to memory of 3544	2360	syststemfile.exe	notepad.exe
PID 2360 wrote to memory of 3544	2360	syststemfile.exe	notepad.exe
PID 776 wrote to memory of 4020	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	systemfiles.exe
PID 776 wrote to memory of 4020	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	systemfiles.exe
PID 776 wrote to memory of 4020	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	systemfiles.exe
PID 4020 wrote to memory of 3392	4020	systemfiles.exe	notepad.exe
PID 4020 wrote to memory of 3392	4020	systemfiles.exe	notepad.exe
PID 4020 wrote to memory of 3392	4020	systemfiles.exe	notepad.exe
PID 3544 wrote to memory of 4056	3544	notepad.exe	systemefile.exe
PID 3544 wrote to memory of 4056	3544	notepad.exe	systemefile.exe
PID 3544 wrote to memory of 4056	3544	notepad.exe	systemefile.exe
PID 4020 wrote to memory of 3392	4020	systemfiles.exe	notepad.exe
PID 4020 wrote to memory of 3392	4020	systemfiles.exe	notepad.exe
PID 4056 wrote to memory of 4084	4056	systemefile.exe	systemefile.exe
PID 4056 wrote to memory of 4084	4056	systemefile.exe	systemefile.exe
PID 4056 wrote to memory of 4084	4056	systemefile.exe	systemefile.exe
PID 776 wrote to memory of 3236	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	WScript.exe
PID 776 wrote to memory of 3236	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	WScript.exe
PID 776 wrote to memory of 3236	776	9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe	WScript.exe
PID 4056 wrote to memory of 2976	4056	systemefile.exe	systemefile.exe
PID 4056 wrote to memory of 2976	4056	systemefile.exe	systemefile.exe
PID 4056 wrote to memory of 2976	4056	systemefile.exe	systemefile.exe
PID 3392 wrote to memory of 2308	3392	notepad.exe	systemefile.exe
PID 3392 wrote to memory of 2308	3392	notepad.exe	systemefile.exe
PID 3392 wrote to memory of 2308	3392	notepad.exe	systemefile.exe
PID 2308 wrote to memory of 3940	2308	systemefile.exe	systemstability.exe
PID 2308 wrote to memory of 3940	2308	systemefile.exe	systemstability.exe
PID 2308 wrote to memory of 3940	2308	systemefile.exe	systemstability.exe
PID 2308 wrote to memory of 8	2308	systemefile.exe	systemstability.exe
PID 2308 wrote to memory of 8	2308	systemefile.exe	systemstability.exe
PID 2308 wrote to memory of 8	2308	systemefile.exe	systemstability.exe
PID 4084 wrote to memory of 3508	4084	systemefile.exe	Host.exe
PID 4084 wrote to memory of 3508	4084	systemefile.exe	Host.exe
PID 4084 wrote to memory of 3508	4084	systemefile.exe	Host.exe
PID 3508 wrote to memory of 3544	3508	Host.exe	notepad.exe
PID 3508 wrote to memory of 3544	3508	Host.exe	notepad.exe
PID 3508 wrote to memory of 3544	3508	Host.exe	notepad.exe
PID 2976 wrote to memory of 4044	2976	systemefile.exe	systemefile.exe
PID 2976 wrote to memory of 4044	2976	systemefile.exe	systemefile.exe
PID 2976 wrote to memory of 4044	2976	systemefile.exe	systemefile.exe
PID 3508 wrote to memory of 3544	3508	Host.exe	notepad.exe
PID 3508 wrote to memory of 3544	3508	Host.exe	notepad.exe
PID 3236 wrote to memory of 3420	3236	systemefile.exe	wscript.exe
PID 3236 wrote to memory of 3420	3236	systemefile.exe	wscript.exe
PID 3236 wrote to memory of 3420	3236	systemefile.exe	wscript.exe
PID 4044 wrote to memory of 2128	4044	systemefile.exe	systemefile.exe
PID 4044 wrote to memory of 2128	4044	systemefile.exe	systemefile.exe
PID 4044 wrote to memory of 2128	4044	systemefile.exe	systemefile.exe
PID 3544 wrote to memory of 2736	3544	notepad.exe	systemefile.exe
PID 3544 wrote to memory of 2736	3544	notepad.exe	systemefile.exe
PID 3544 wrote to memory of 2736	3544	notepad.exe	systemefile.exe
PID 4044 wrote to memory of 2308	4044	systemefile.exe	systemefile.exe
PID 4044 wrote to memory of 2308	4044	systemefile.exe	systemefile.exe
PID 4044 wrote to memory of 2308	4044	systemefile.exe	systemefile.exe
PID 3236 wrote to memory of 3856	3236	systemefile.exe	wscript.exe
PID 3236 wrote to memory of 3856	3236	systemefile.exe	wscript.exe
PID 3236 wrote to memory of 3856	3236	systemefile.exe	wscript.exe
PID 2736 wrote to memory of 2016	2736	systemefile.exe	systemefile.exe

C:\Users\Admin\AppData\Local\Temp\9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe
"C:\Users\Admin\AppData\Local\Temp\9b61e86cf6899344b6e9564e1dbfacc24c8a99e9e9be8cd8f764dba7d4f7927e.bin.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
PID:3544

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4056

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
7⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3544

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:2736

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4084 259285406
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4044

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2128

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2128 259287296
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2308

C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3392

C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe"
4⤵
PID:2308

C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe" 2 3940 259285812
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:8

C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe"
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles878.js"
2⤵
PID:3236

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js"
3⤵
- Drops startup file
- Adds Run key to start application
PID:3420

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\systemfiles878.js"
3⤵
- Drops startup file
- Adds Run key to start application
PID:3856

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js"
4⤵
PID:708

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
- Executes dropped EXE
PID:2016

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2016 259287656
1⤵
PID:3836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:184

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3044 259288343
3⤵
PID:1848

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
- Executes dropped EXE
PID:3044

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:1540

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:1848

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:2836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2836 259290078
2⤵
PID:192

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1352

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:184

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
5⤵
- Executes dropped EXE
PID:2600

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:2836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:2192

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:3064

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3064 259292390
8⤵
PID:1848

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:1540

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:3644

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3644 259292609
10⤵
PID:3236

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:3836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:3064

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3064 259293515
12⤵
- Executes dropped EXE
- Drops startup file
- NTFS ADS
PID:2836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:2840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:216

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 216 259293828
14⤵
PID:3392

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:2080

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:4380

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
13⤵
PID:5316

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
14⤵
PID:6216

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:6312

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6452 259308328
16⤵
PID:6504

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
16⤵
PID:6452

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 184 259291625
4⤵
PID:2840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:1540

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:2304

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2304 259292140
6⤵
- Executes dropped EXE
PID:1588

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:3404

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3080 259293937
8⤵
PID:1288

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:3080

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
9⤵
PID:4232

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:4704

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:4928

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
12⤵
PID:4276

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
13⤵
PID:4216

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4880

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4868 259299593
15⤵
PID:4976

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
16⤵
PID:5680

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:5772

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5772 259303015
17⤵
PID:5784

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:4868

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
16⤵
PID:5332

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
17⤵
PID:5396

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:5708

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:5860

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5860 259303203
19⤵
PID:5904

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4928 259298109
11⤵
PID:4900

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:4652

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4796

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
14⤵
PID:5240

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
15⤵
PID:4524

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4796 259299468
13⤵
PID:4712

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:5404

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2724

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1540 259289640
1⤵
PID:2844

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:2716

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:2264

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2264 259294343
2⤵
PID:2316

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
PID:1848

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:3964

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
5⤵
PID:368

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:2204

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:216

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
9⤵
PID:4232

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
10⤵
PID:4424

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:4572

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:4740

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
13⤵
PID:3080

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4740 259296765
12⤵
PID:4760

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4244

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4196 259297781
14⤵
PID:4368

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:5084

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4500 259302046
16⤵
PID:4372

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
16⤵
PID:4500

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
17⤵
PID:6924

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
18⤵
PID:7020

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 216 259295703
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2736

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:4280

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4520 259296437
10⤵
PID:4552

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:5028

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1204 259297265
12⤵
PID:4104

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:5104

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4704 259305203
14⤵
PID:5392

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4704

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:1204

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
13⤵
PID:5208

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
14⤵
PID:4140

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:5704

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:4520

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
11⤵
PID:4896

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
12⤵
PID:4964

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:5112

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1848

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
15⤵
PID:4392

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
16⤵
PID:4580

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:3836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:4340

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
19⤵
PID:6956

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4340 259301171
18⤵
PID:5100

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1848 259297453
14⤵
PID:4108

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:5028

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
16⤵
PID:4932

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
17⤵
PID:5332

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
18⤵
PID:5020

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:5024

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
20⤵
PID:4136

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4136 259307328
20⤵
PID:4440

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4932 259301578
16⤵
PID:4696

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:6344

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6496 259308406
18⤵
PID:6540

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:6496

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3964 259295187
4⤵
PID:192

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:2264

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3236 259295484
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1540

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:4196

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:4440

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
9⤵
PID:4876

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4440 259296281
8⤵
PID:4448

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:5000

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:5104

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
11⤵
PID:4224

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
12⤵
PID:4544

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4636

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4888

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
15⤵
PID:7032

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
16⤵
PID:5020

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4888 259299890
14⤵
PID:4992

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5104 259297234
10⤵
PID:2320

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:4776

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:4344

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
13⤵
PID:3960

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
14⤵
PID:2264

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:5412

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4212 259304437
16⤵
PID:4572

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4344 259300125
12⤵
PID:4184

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4912

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:5732

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5732 259304296
14⤵
PID:4608

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3236

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
7⤵
PID:4140

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
8⤵
PID:4164

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:4288

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4512 259296421
10⤵
PID:4540

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:4932

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5016 259297078
12⤵
PID:5036

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4384

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4468 259297906
14⤵
PID:4708

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:4532

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
16⤵
PID:5084

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
17⤵
PID:4816

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
18⤵
PID:4728

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:4924

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5044 259301171
20⤵
PID:4960

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
20⤵
PID:5044

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
21⤵
PID:6940

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5084 259298578
16⤵
PID:4856

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:4152

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:4840

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
19⤵
PID:4672

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
20⤵
PID:2320

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
21⤵
PID:3392

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
22⤵
PID:4524

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4524 259307203
22⤵
PID:4724

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4840 259301671
18⤵
PID:4856

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:6208

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
20⤵
PID:6332

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6332 259308015
20⤵
PID:6360

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4468

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
15⤵
PID:4752

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
16⤵
PID:4816

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:4840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:3872

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3872 259298687
18⤵
PID:5092

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:4492

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4748 259300312
20⤵
PID:4836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
21⤵
PID:6656

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
22⤵
PID:6692

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6692 259308937
22⤵
PID:6708

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
20⤵
PID:4748

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
21⤵
PID:5020

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
22⤵
PID:6200

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
23⤵
PID:6276

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6428 259308281
24⤵
PID:6468

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
24⤵
PID:6428

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:5016

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
13⤵
PID:1632

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:4900

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
12⤵
- Executes dropped EXE
PID:2844

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
13⤵
PID:5332

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4760

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:4604

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4604 259304531
15⤵
PID:4900

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4900 259300046
11⤵
PID:4264

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:5392

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5740 259304250
13⤵
PID:5792

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:5740

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:4512

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
11⤵
PID:4884

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
12⤵
PID:4956

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:5096

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:2140

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
15⤵
PID:4332

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
16⤵
PID:4252

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
17⤵
PID:4488

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
18⤵
PID:4220

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
19⤵
PID:4136

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
20⤵
PID:5684

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
21⤵
PID:5352

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
22⤵
PID:5684

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5684 259307500
22⤵
PID:3392

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4220 259301500
18⤵
PID:5016

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
19⤵
PID:6232

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
20⤵
PID:6300

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6300 259307937
20⤵
PID:6324

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2140 259297437
14⤵
- Executes dropped EXE
PID:2840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:368

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
16⤵
PID:1772

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
17⤵
PID:6888

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
18⤵
PID:7004

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 1772 259301531
16⤵
PID:4284

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:184

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:3064

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:3872

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
PID:2316

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
4⤵
PID:2840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:192

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:4084

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
7⤵
PID:4176

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
8⤵
PID:4316

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:4476

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:4636

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
11⤵
PID:2200

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
12⤵
PID:4128

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4456

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4636 259296578
10⤵
PID:4660

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:4184

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4240 259297765
12⤵
PID:4496

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:5352

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4448

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4448 259304015
14⤵
PID:5408

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4084 259295703
6⤵
PID:1484

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:4268

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:4532

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
9⤵
PID:5080

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
10⤵
- Executes dropped EXE
PID:192

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:1908

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4404 259297812
12⤵
PID:4268

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4444

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4896 259302062
14⤵
PID:5092

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4896

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
15⤵
PID:6984

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
16⤵
PID:7132

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4532 259296468
8⤵
PID:4580

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
- Executes dropped EXE
PID:3836

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4380 259297765
10⤵
PID:4616

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:6700

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:6800

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6800 259309218
12⤵
PID:6816

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3872 259295062
2⤵
PID:2616

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
PID:2304

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:960

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
5⤵
PID:2080

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:4128

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:4224

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4304 259296140
8⤵
PID:4336

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:1772

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4272 259300312
10⤵
PID:3964

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:5388

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:4300

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4300 259304484
12⤵
PID:1484

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:4272

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
11⤵
PID:4136

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
12⤵
PID:5036

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:4288

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:4156

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4156 259304812
14⤵
PID:5580

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:4304

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
9⤵
PID:4836

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
10⤵
PID:4588

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:2316

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4908 259300234
12⤵
PID:4724

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
13⤵
PID:5352

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5700 259305500
14⤵
PID:2220

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
14⤵
PID:5700

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:4908

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
13⤵
PID:4184

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
14⤵
PID:5332

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
15⤵
PID:5576

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 960 259295484
4⤵
PID:1288

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:4188

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4296 259296140
6⤵
PID:4328

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:4872

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4704 259300265
8⤵
PID:4752

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:5200

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4552 259304781
10⤵
PID:4824

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:4552

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:4704

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
9⤵
PID:5708

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
10⤵
PID:4244

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:4136

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
12⤵
PID:4820

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4820 259305218
12⤵
PID:4868

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:4296

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
7⤵
PID:4608

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
8⤵
PID:4452

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:4540

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 184 259294203
1⤵
PID:3108

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:4944

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:5088

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
PID:3392

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
PID:4188

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
5⤵
PID:5244

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:5832

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:5400

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5400 259307171
7⤵
PID:5244

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3392 259297421
3⤵
PID:4084

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:5632

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5812 259306890
5⤵
PID:5260

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:5812

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:4404

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
PID:4340

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
PID:4776

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:4392

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:4436

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
6⤵
PID:6896

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
7⤵
PID:7048

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4436 259301531
5⤵
PID:4764

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:4416

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:4688

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
PID:4920

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
PID:776

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
5⤵
PID:4184

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:4472

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:4744

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
8⤵
PID:200

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
9⤵
PID:5072

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
10⤵
PID:1632

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
11⤵
PID:5116

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5116 259304500
11⤵
PID:4744

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4744 259299687
7⤵
PID:5088

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:4820

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5720 259304265
9⤵
PID:5760

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:5720

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4920 259298140
3⤵
PID:4908

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:4440

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4732 259299765
5⤵
PID:5096

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:5760

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:5868

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5868 259303218
7⤵
PID:5916

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:4732

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
6⤵
PID:5576

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
7⤵
PID:5692

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:5808

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5808 259305578
7⤵
PID:4760

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:4196

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
PID:4660

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
PID:4700

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:4332

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:4252

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
6⤵
PID:5748

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
7⤵
PID:6192

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:6284

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:6436

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6436 259308281
9⤵
PID:6476

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4252 259301531
5⤵
PID:4412

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:6672

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:6744

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6744 259309031
7⤵
PID:6768

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:4240

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
PID:3180

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
PID:4432

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:4732

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:4684

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4684 259304500
5⤵
PID:5196

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4820 259298031
1⤵
PID:4520

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:2036

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2192

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
PID:4932

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
5⤵
PID:4692

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:1484

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 4832 259302046
7⤵
PID:368

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
7⤵
PID:4832

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
8⤵
PID:6908

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
9⤵
PID:7012

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2192 259298921
3⤵
PID:3584

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:4980

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
- Executes dropped EXE
PID:2304

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
6⤵
PID:7064

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
7⤵
PID:4472

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 2304 259302453
5⤵
PID:3236

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:4820

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
PID:4732

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
PID:5096

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
4⤵
PID:4580

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
5⤵
PID:5072

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
6⤵
PID:5324

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
7⤵
PID:5388

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
8⤵
PID:5716

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
9⤵
PID:5840

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5840 259303171
9⤵
PID:5876

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5072 259299046
5⤵
PID:5036

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
6⤵
PID:5728

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5848 259303171
7⤵
PID:5884

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:5848

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:5824

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:6000

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 6000 259303437
2⤵
PID:6036

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:4212

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:5272

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 5272 259305656
1⤵
PID:4772

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 3080 259305546
1⤵
PID:5708

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:5832

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
2⤵
PID:428

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe" 2 428 259306078
2⤵
PID:3108

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:3080

C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
"C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe"
1⤵
PID:4856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\systemfiles878.js
MD5
327faf02e528e6e356fc2e92fd8c1d3e

SHA1
550f1188d669145900135c0300630deebcfadf23

SHA256
03849d530ff832cdb13c5d8dd62772575f3f6c56c7cccf5ecd333d5ea27e6efb

SHA512
a23ee3b5fd140fea5b025676b2bebe9e1efb7ac8b836c83d57e3695a185c3dc676cfd444acd34116239679515fa45de3a5cd639eb5c3991d880d323a1ad56281

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\syststemfile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\systemfiles878.js
MD5
327faf02e528e6e356fc2e92fd8c1d3e

SHA1
550f1188d669145900135c0300630deebcfadf23

SHA256
03849d530ff832cdb13c5d8dd62772575f3f6c56c7cccf5ecd333d5ea27e6efb

SHA512
a23ee3b5fd140fea5b025676b2bebe9e1efb7ac8b836c83d57e3695a185c3dc676cfd444acd34116239679515fa45de3a5cd639eb5c3991d880d323a1ad56281

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles.vbs
MD5
6b17a5baf42e2eced60b40326f06d539

SHA1
7e9f1a9d9f83e89cea6eb1442c2a70dfaa9d94a3

SHA256
4dcd87ba10ee62cea3f021b7d91ed36240e9c64d3218bfaf942e1677695cc411

SHA512
13a02f02088552997c07545fae4d2f0f35490398cc5e46e662c4041bdd905cd65b2e00dd957e369f31d6e020d38978ed3ca9525529c0782badf742a6b00ea651

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemfiles878.js
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemefile.exe
MD5
a99f34d26fb92545294088aea2850fc2

SHA1
a6d438fc7dc71a5d7cc92076c35604d16147fa1d

SHA256
bb7c29be3684dce97f70dd79c7900955cdb9409c668e195defa5fa2b9a8174aa

SHA512
9bccec87b7597998d3182dfcbc50100fbcfd54524103aff52ea6a13528274c1751c8a550c209fdf25f34b63a306ae4036799fc87f970d0e32f8e62c27e8875fc

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\appdata\systemstability.exe
MD5
ceb6128a4a0dae23a13dbc714f482ecf

SHA1
fdcac72c933cabc746e21b08c28386fd5cc879be

SHA256
3e7e6c0c683f38597cc9ae71a41b4faec31e07e6244693d4d8e2dfda99e02225

SHA512
0048a91e94854587be92929e11562b69852f32b6e4646ae8342149ff94241f69de5ce9bda43f0102e94e38c417abd341dbcb384261299f955ecc7a4c13a54e1f

Download Submit
C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js
MD5
45f5c927b03df5996b42c0eab0e0f7c7

SHA1
a6e990d3c7bc1e94a1c8fd96674ba818f7e0b83e

SHA256
4fe7a0c1b20ae55003849f7de12b0756434b956676d02fbff06daa9c8d85b0f5

SHA512
4716fc8e7485698d9c4c6c6a52c64fef13e737a935ed4d9fb84e31c1e3a403d6f21cfc64f4910e7bbd38275ecafa15a456044ab68f3471d722585decf04077e9

Download Submit
C:\Users\Admin\AppData\Roaming\lfQEWRrrdw.js
MD5
45f5c927b03df5996b42c0eab0e0f7c7

SHA1
a6e990d3c7bc1e94a1c8fd96674ba818f7e0b83e

SHA256
4fe7a0c1b20ae55003849f7de12b0756434b956676d02fbff06daa9c8d85b0f5

SHA512
4716fc8e7485698d9c4c6c6a52c64fef13e737a935ed4d9fb84e31c1e3a403d6f21cfc64f4910e7bbd38275ecafa15a456044ab68f3471d722585decf04077e9

Download Submit
memory/8-147-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/8-138-0x0000000000000000-mapping.dmp

Download
memory/8-146-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/8-148-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/184-195-0x0000000000570000-0x000000000061E000-memory.dmp

Filesize
696KB

Download
memory/184-186-0x0000000000000000-mapping.dmp

Download
memory/184-193-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/184-196-0x0000000000570000-0x000000000061E000-memory.dmp

Filesize
696KB

Download
memory/184-244-0x000000000040242D-mapping.dmp

Download
memory/184-297-0x000000000040242D-mapping.dmp

Download
memory/192-232-0x0000000000000000-mapping.dmp

Download
memory/192-241-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/216-285-0x000000000040242D-mapping.dmp

Download
memory/708-229-0x0000000000000000-mapping.dmp

Download
memory/1288-290-0x0000000000000000-mapping.dmp

Download
memory/1352-248-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1352-242-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/1352-235-0x0000000000000000-mapping.dmp

Download
memory/1540-215-0x000000000040242D-mapping.dmp

Download
memory/1540-268-0x0000000000000000-mapping.dmp

Download
memory/1540-252-0x0000000000000000-mapping.dmp

Download
memory/1588-257-0x0000000000000000-mapping.dmp

Download
memory/1848-208-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/1848-205-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1848-304-0x0000000000000000-mapping.dmp

Download
memory/1848-264-0x0000000000000000-mapping.dmp

Download
memory/1848-198-0x0000000000000000-mapping.dmp

Download
memory/1848-239-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/1848-224-0x0000000000000000-mapping.dmp

Download
memory/1848-236-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/2016-176-0x000000000040242D-mapping.dmp

Download
memory/2080-293-0x0000000000000000-mapping.dmp

Download
memory/2128-168-0x000000000040242D-mapping.dmp

Download
memory/2192-260-0x0000000000000000-mapping.dmp

Download
memory/2264-300-0x000000000040242D-mapping.dmp

Download
memory/2304-255-0x000000000040242D-mapping.dmp

Download
memory/2308-222-0x0000000000640000-0x000000000078A000-memory.dmp

Filesize
1.3MB

Download
memory/2308-129-0x0000000000000000-mapping.dmp

Download
memory/2308-170-0x0000000000000000-mapping.dmp

Download
memory/2308-134-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/2308-157-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/2308-212-0x0000000000640000-0x000000000078A000-memory.dmp

Filesize
1.3MB

Download
memory/2308-228-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2308-158-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2316-301-0x0000000000000000-mapping.dmp

Download
memory/2360-133-0x0000000000600000-0x000000000074A000-memory.dmp

Filesize
1.3MB

Download
memory/2360-143-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/2360-139-0x0000000002060000-0x000000000206C000-memory.dmp

Filesize
48KB

Download
memory/2360-114-0x0000000000000000-mapping.dmp

Download
memory/2600-250-0x0000000000000000-mapping.dmp

Download
memory/2616-305-0x0000000000000000-mapping.dmp

Download
memory/2716-295-0x0000000000000000-mapping.dmp

Download
memory/2724-214-0x0000000000640000-0x000000000078A000-memory.dmp

Filesize
1.3MB

Download
memory/2724-206-0x0000000000000000-mapping.dmp

Download
memory/2724-213-0x0000000000640000-0x000000000078A000-memory.dmp

Filesize
1.3MB

Download
memory/2724-216-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/2736-169-0x0000000000000000-mapping.dmp

Download
memory/2736-218-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/2736-202-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2836-230-0x000000000040242D-mapping.dmp

Download
memory/2836-254-0x0000000000000000-mapping.dmp

Download
memory/2836-278-0x0000000000000000-mapping.dmp

Download
memory/2840-281-0x0000000000000000-mapping.dmp

Download
memory/2840-246-0x0000000000000000-mapping.dmp

Download
memory/2844-217-0x0000000000000000-mapping.dmp

Download
memory/2844-223-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/2844-227-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/2976-135-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/2976-160-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/2976-137-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2976-128-0x0000000000000000-mapping.dmp

Download
memory/3044-194-0x000000000040242D-mapping.dmp

Download
memory/3064-302-0x0000000000000000-mapping.dmp

Download
memory/3064-263-0x000000000040242D-mapping.dmp

Download
memory/3064-276-0x000000000040242D-mapping.dmp

Download
memory/3080-289-0x000000000040242D-mapping.dmp

Download
memory/3108-299-0x0000000000000000-mapping.dmp

Download
memory/3236-125-0x0000000000000000-mapping.dmp

Download
memory/3236-271-0x0000000000000000-mapping.dmp

Download
memory/3392-121-0x0000000000000000-mapping.dmp

Download
memory/3392-286-0x0000000000000000-mapping.dmp

Download
memory/3404-283-0x0000000000000000-mapping.dmp

Download
memory/3420-167-0x0000000000000000-mapping.dmp

Download
memory/3508-183-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3508-161-0x0000000000000000-mapping.dmp

Download
memory/3508-177-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3544-145-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/3544-164-0x0000000000000000-mapping.dmp

Download
memory/3544-117-0x0000000000000000-mapping.dmp

Download
memory/3644-270-0x000000000040242D-mapping.dmp

Download
memory/3836-187-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/3836-274-0x0000000000000000-mapping.dmp

Download
memory/3836-190-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/3836-179-0x0000000000000000-mapping.dmp

Download
memory/3856-175-0x0000000000000000-mapping.dmp

Download
memory/3872-303-0x000000000040242D-mapping.dmp

Download
memory/3940-144-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3940-136-0x000000000047D4A0-mapping.dmp

Download
memory/3940-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4020-151-0x00000000005A0000-0x00000000006EA000-memory.dmp

Filesize
1.3MB

Download
memory/4020-150-0x00000000005A0000-0x00000000006EA000-memory.dmp

Filesize
1.3MB

Download
memory/4020-149-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/4020-118-0x0000000000000000-mapping.dmp

Download
memory/4044-192-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4044-185-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/4044-165-0x0000000000000000-mapping.dmp

Download
memory/4056-155-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/4056-122-0x0000000000000000-mapping.dmp

Download
memory/4056-153-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/4084-156-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4084-126-0x000000000040242D-mapping.dmp

Download