Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 15:01
Behavioral task
behavioral1
Sample
47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe
Resource
win10v2004-20220812-en
General
-
Target
47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe
-
Size
275KB
-
MD5
3bfe4b1936c05e45349746ed9adb36e3
-
SHA1
938998c4f5d4258577a99771df249e4d36a32f07
-
SHA256
47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
-
SHA512
2ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
SSDEEP
6144:yCETCo8xh5516v+2UUA/HH6s7ejUxVPw/8kfvpIW06fc1:ueoMLl2UUmLlxtw/82Iafc
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 64 IoCs
Processes:
system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\system32\\system\\system.exe\"" system.exe -
Adds policy Run key to start application 2 TTPs 64 IoCs
Processes:
system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exe47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe -
Executes dropped EXE 64 IoCs
Processes:
system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exepid process 860 system.exe 1568 system.exe 1400 system.exe 2280 system.exe 2372 system.exe 3856 system.exe 3364 system.exe 4452 system.exe 4836 system.exe 3160 system.exe 3584 system.exe 1284 system.exe 4712 system.exe 4792 system.exe 3524 system.exe 396 system.exe 1868 system.exe 3640 system.exe 1704 system.exe 2136 system.exe 4928 system.exe 3920 system.exe 3124 system.exe 4960 system.exe 1204 system.exe 116 system.exe 3864 system.exe 4396 system.exe 4452 system.exe 4808 system.exe 1576 system.exe 604 system.exe 1668 system.exe 1556 system.exe 1072 system.exe 2336 system.exe 1552 system.exe 3788 system.exe 432 system.exe 4524 system.exe 992 system.exe 3496 system.exe 4600 system.exe 3096 system.exe 4380 system.exe 260 system.exe 3044 system.exe 4292 system.exe 4868 system.exe 4028 system.exe 904 system.exe 4432 system.exe 3584 system.exe 2692 system.exe 824 system.exe 2684 system.exe 1816 system.exe 4832 system.exe 3780 system.exe 2044 system.exe 4100 system.exe 2688 system.exe 3140 system.exe 1972 system.exe -
Modifies Installed Components in the registry 2 TTPs 64 IoCs
Processes:
47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Windows\\system32\\system\\system.exe restart" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe restart" system.exe -
Processes:
resource yara_rule behavioral2/memory/4920-132-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/4920-133-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/4920-137-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/860-138-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/860-142-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/1568-143-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/1568-146-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/1400-147-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/1400-151-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/2280-153-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/2280-156-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/2372-160-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/3856-161-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/3856-165-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/3364-166-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/3364-170-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/4452-171-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/4452-175-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/3160-179-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/4836-180-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/3160-184-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/3584-185-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/3584-189-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/1284-190-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/1284-194-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/4712-195-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/4712-199-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/4792-201-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Windows\SysWOW64\system\system.exe upx C:\Windows\SysWOW64\system\system.exe upx C:\Users\Admin\AppData\Roaming\system\system.exe upx behavioral2/memory/3524-207-0x0000000000C80000-0x0000000000D69000-memory.dmp upx behavioral2/memory/396-208-0x0000000000C80000-0x0000000000D69000-memory.dmp upx C:\Users\Admin\AppData\Roaming\system\system.exe upx C:\Windows\SysWOW64\system\system.exe upx behavioral2/memory/396-212-0x0000000000C80000-0x0000000000D69000-memory.dmp upx -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation system.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exe47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run system.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\system\\system.exe" system.exe -
Drops file in System32 directory 64 IoCs
Processes:
system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exe47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exedescription ioc process File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File created C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe File opened for modification C:\Windows\SysWOW64\system\system.exe system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exe47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exesystem.exesystem.exesystem.exesystem.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom system.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 system.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exedescription pid process target process PID 4920 wrote to memory of 860 4920 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe system.exe PID 4920 wrote to memory of 860 4920 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe system.exe PID 4920 wrote to memory of 860 4920 47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe system.exe PID 860 wrote to memory of 1568 860 system.exe system.exe PID 860 wrote to memory of 1568 860 system.exe system.exe PID 860 wrote to memory of 1568 860 system.exe system.exe PID 1568 wrote to memory of 1400 1568 system.exe system.exe PID 1568 wrote to memory of 1400 1568 system.exe system.exe PID 1568 wrote to memory of 1400 1568 system.exe system.exe PID 1400 wrote to memory of 2280 1400 system.exe system.exe PID 1400 wrote to memory of 2280 1400 system.exe system.exe PID 1400 wrote to memory of 2280 1400 system.exe system.exe PID 2280 wrote to memory of 2372 2280 system.exe system.exe PID 2280 wrote to memory of 2372 2280 system.exe system.exe PID 2280 wrote to memory of 2372 2280 system.exe system.exe PID 2372 wrote to memory of 3856 2372 system.exe system.exe PID 2372 wrote to memory of 3856 2372 system.exe system.exe PID 2372 wrote to memory of 3856 2372 system.exe system.exe PID 3856 wrote to memory of 3364 3856 system.exe system.exe PID 3856 wrote to memory of 3364 3856 system.exe system.exe PID 3856 wrote to memory of 3364 3856 system.exe system.exe PID 3364 wrote to memory of 4452 3364 system.exe system.exe PID 3364 wrote to memory of 4452 3364 system.exe system.exe PID 3364 wrote to memory of 4452 3364 system.exe system.exe PID 4452 wrote to memory of 4836 4452 system.exe system.exe PID 4452 wrote to memory of 4836 4452 system.exe system.exe PID 4452 wrote to memory of 4836 4452 system.exe system.exe PID 4836 wrote to memory of 3160 4836 system.exe system.exe PID 4836 wrote to memory of 3160 4836 system.exe system.exe PID 4836 wrote to memory of 3160 4836 system.exe system.exe PID 3160 wrote to memory of 3584 3160 system.exe system.exe PID 3160 wrote to memory of 3584 3160 system.exe system.exe PID 3160 wrote to memory of 3584 3160 system.exe system.exe PID 3584 wrote to memory of 1284 3584 system.exe system.exe PID 3584 wrote to memory of 1284 3584 system.exe system.exe PID 3584 wrote to memory of 1284 3584 system.exe system.exe PID 1284 wrote to memory of 4712 1284 system.exe system.exe PID 1284 wrote to memory of 4712 1284 system.exe system.exe PID 1284 wrote to memory of 4712 1284 system.exe system.exe PID 4712 wrote to memory of 4792 4712 system.exe system.exe PID 4712 wrote to memory of 4792 4712 system.exe system.exe PID 4712 wrote to memory of 4792 4712 system.exe system.exe PID 4792 wrote to memory of 3524 4792 system.exe system.exe PID 4792 wrote to memory of 3524 4792 system.exe system.exe PID 4792 wrote to memory of 3524 4792 system.exe system.exe PID 3524 wrote to memory of 396 3524 system.exe system.exe PID 3524 wrote to memory of 396 3524 system.exe system.exe PID 3524 wrote to memory of 396 3524 system.exe system.exe PID 396 wrote to memory of 1868 396 system.exe system.exe PID 396 wrote to memory of 1868 396 system.exe system.exe PID 396 wrote to memory of 1868 396 system.exe system.exe PID 1868 wrote to memory of 3640 1868 system.exe system.exe PID 1868 wrote to memory of 3640 1868 system.exe system.exe PID 1868 wrote to memory of 3640 1868 system.exe system.exe PID 3640 wrote to memory of 1704 3640 system.exe system.exe PID 3640 wrote to memory of 1704 3640 system.exe system.exe PID 3640 wrote to memory of 1704 3640 system.exe system.exe PID 1704 wrote to memory of 2136 1704 system.exe system.exe PID 1704 wrote to memory of 2136 1704 system.exe system.exe PID 1704 wrote to memory of 2136 1704 system.exe system.exe PID 2136 wrote to memory of 4928 2136 system.exe system.exe PID 2136 wrote to memory of 4928 2136 system.exe system.exe PID 2136 wrote to memory of 4928 2136 system.exe system.exe PID 4928 wrote to memory of 3920 4928 system.exe system.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe"C:\Users\Admin\AppData\Local\Temp\47739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"5⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"6⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"8⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"9⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"11⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"13⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"14⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"15⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"16⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"17⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"19⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"20⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"21⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"22⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"23⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"24⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"25⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"26⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"27⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"28⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"29⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"30⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"31⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"32⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"33⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"34⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"35⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"36⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"37⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"38⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"39⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"40⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"41⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"42⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"43⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"44⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"45⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"46⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"47⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"48⤵
- Executes dropped EXE
- Checks computer location settings
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"50⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"51⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"52⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"53⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"54⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"55⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"56⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"57⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"58⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"59⤵
- Executes dropped EXE
- Checks computer location settings
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"60⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"61⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"62⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"63⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"64⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"65⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"66⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"67⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"68⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"69⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Checks computer location settings
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"70⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"71⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"72⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"73⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"74⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"75⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"76⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"77⤵
- Adds policy Run key to start application
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"78⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"79⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"80⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"81⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"82⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"83⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"84⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"85⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"86⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"87⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"88⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"89⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"90⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"91⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"92⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"93⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"94⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"95⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"96⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"97⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"98⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"99⤵
- Adds policy Run key to start application
- Checks computer location settings
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"100⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\system\system.exe"C:\Users\Admin\AppData\Roaming\system\system.exe"101⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\system\system.exe"C:\Windows\system32\system\system.exe"102⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Users\Admin\AppData\Roaming\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
C:\Windows\SysWOW64\system\system.exeFilesize
275KB
MD53bfe4b1936c05e45349746ed9adb36e3
SHA1938998c4f5d4258577a99771df249e4d36a32f07
SHA25647739c4d3babe63922e4b49f098d616769d7beb5bffb3572e4e87b50a3f1ac7d
SHA5122ccfd80020aff6d14a9ba8c9b438a64dc61c7315f0d27af5ffcfd76d6ac364972aacf0d41f2f53ea0710903757b1789e0b56dd6055e0cda46875e5a3522c2c65
-
memory/116-256-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/116-260-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/116-253-0x0000000000000000-mapping.dmp
-
memory/260-322-0x0000000000000000-mapping.dmp
-
memory/396-212-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/396-205-0x0000000000000000-mapping.dmp
-
memory/396-208-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/432-303-0x0000000000000000-mapping.dmp
-
memory/604-287-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/604-282-0x0000000000000000-mapping.dmp
-
memory/824-346-0x0000000000000000-mapping.dmp
-
memory/860-142-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/860-134-0x0000000000000000-mapping.dmp
-
memory/860-138-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/904-334-0x0000000000000000-mapping.dmp
-
memory/992-308-0x0000000000000000-mapping.dmp
-
memory/1072-292-0x0000000000000000-mapping.dmp
-
memory/1072-294-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1204-251-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1204-248-0x0000000000000000-mapping.dmp
-
memory/1204-255-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1284-194-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1284-187-0x0000000000000000-mapping.dmp
-
memory/1284-190-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1400-144-0x0000000000000000-mapping.dmp
-
memory/1400-147-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1400-151-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1552-297-0x0000000000000000-mapping.dmp
-
memory/1556-293-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1556-291-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1556-289-0x0000000000000000-mapping.dmp
-
memory/1568-146-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1568-139-0x0000000000000000-mapping.dmp
-
memory/1568-143-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1576-277-0x0000000000000000-mapping.dmp
-
memory/1576-280-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1576-284-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1668-290-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1668-286-0x0000000000000000-mapping.dmp
-
memory/1668-288-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1704-226-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1704-219-0x0000000000000000-mapping.dmp
-
memory/1704-222-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1816-351-0x0000000000000000-mapping.dmp
-
memory/1868-210-0x0000000000000000-mapping.dmp
-
memory/1868-216-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/1972-371-0x0000000000000000-mapping.dmp
-
memory/2044-360-0x0000000000000000-mapping.dmp
-
memory/2136-224-0x0000000000000000-mapping.dmp
-
memory/2136-227-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/2136-231-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/2280-153-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/2280-156-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/2280-149-0x0000000000000000-mapping.dmp
-
memory/2336-295-0x0000000000000000-mapping.dmp
-
memory/2372-160-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/2372-154-0x0000000000000000-mapping.dmp
-
memory/2684-349-0x0000000000000000-mapping.dmp
-
memory/2688-365-0x0000000000000000-mapping.dmp
-
memory/2692-343-0x0000000000000000-mapping.dmp
-
memory/3044-325-0x0000000000000000-mapping.dmp
-
memory/3096-316-0x0000000000000000-mapping.dmp
-
memory/3124-246-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3124-239-0x0000000000000000-mapping.dmp
-
memory/3124-243-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3140-368-0x0000000000000000-mapping.dmp
-
memory/3160-179-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3160-184-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3160-177-0x0000000000000000-mapping.dmp
-
memory/3364-163-0x0000000000000000-mapping.dmp
-
memory/3364-166-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3364-170-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3496-311-0x0000000000000000-mapping.dmp
-
memory/3524-202-0x0000000000000000-mapping.dmp
-
memory/3524-207-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3584-182-0x0000000000000000-mapping.dmp
-
memory/3584-189-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3584-185-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3584-340-0x0000000000000000-mapping.dmp
-
memory/3640-217-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3640-214-0x0000000000000000-mapping.dmp
-
memory/3640-221-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3780-357-0x0000000000000000-mapping.dmp
-
memory/3788-300-0x0000000000000000-mapping.dmp
-
memory/3856-165-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3856-161-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3856-158-0x0000000000000000-mapping.dmp
-
memory/3864-262-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3864-265-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3864-258-0x0000000000000000-mapping.dmp
-
memory/3920-241-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/3920-234-0x0000000000000000-mapping.dmp
-
memory/3920-237-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4028-332-0x0000000000000000-mapping.dmp
-
memory/4100-362-0x0000000000000000-mapping.dmp
-
memory/4292-326-0x0000000000000000-mapping.dmp
-
memory/4380-319-0x0000000000000000-mapping.dmp
-
memory/4396-263-0x0000000000000000-mapping.dmp
-
memory/4396-269-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4432-337-0x0000000000000000-mapping.dmp
-
memory/4452-175-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4452-270-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4452-267-0x0000000000000000-mapping.dmp
-
memory/4452-274-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4452-171-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4452-168-0x0000000000000000-mapping.dmp
-
memory/4524-306-0x0000000000000000-mapping.dmp
-
memory/4600-314-0x0000000000000000-mapping.dmp
-
memory/4712-199-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4712-195-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4712-192-0x0000000000000000-mapping.dmp
-
memory/4792-201-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4792-197-0x0000000000000000-mapping.dmp
-
memory/4808-279-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4808-272-0x0000000000000000-mapping.dmp
-
memory/4808-275-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4832-354-0x0000000000000000-mapping.dmp
-
memory/4836-173-0x0000000000000000-mapping.dmp
-
memory/4836-180-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4868-329-0x0000000000000000-mapping.dmp
-
memory/4920-133-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4920-132-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4920-137-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4928-236-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4928-229-0x0000000000000000-mapping.dmp
-
memory/4928-232-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB
-
memory/4960-244-0x0000000000000000-mapping.dmp
-
memory/4960-250-0x0000000000C80000-0x0000000000D69000-memory.dmpFilesize
932KB