cdd3ecb63c30de836ab13f573ec82faa0688a3e5ea7e54d2178f984cf709c5c6

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5604fa1cf8d82960162ef353e072ee0N.exe
Size

85KB
MD5

c5604fa1cf8d82960162ef353e072ee0
SHA1

8748c8d9bd5aaa5d2037d1c92b84db048deb789f
SHA256

cdd3ecb63c30de836ab13f573ec82faa0688a3e5ea7e54d2178f984cf709c5c6
SHA512

f840219065d07fa9f5d49b30bd9a142ead388f3d0020a0359d1f0913c69c48792de0506864d91816601509cf9f4af9038e9c9921e70de3893101891c1a70a2f9
SSDEEP

1536:lXEN0rlw3e63tlxIHR6xSA7TWCDYAwNKUEiVghzCcnuaukliBLzQcOOGfbfpZJsV:lnw3DI6xd2Wxco

Score

9^/10

persistence ransomware

Malware Config

Signatures

Renames multiple (203) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	c5604fa1cf8d82960162ef353e072ee0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	system.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\simple.lnk	system.exe

Executes dropped EXE 64 IoCs

pid	Process
2260	system.exe
2832	system.exe
1728	system.exe
1464	system.exe
2284	system.exe
4540	system.exe
1916	system.exe
3212	system.exe
3928	system.exe
2832	system.exe
2004	system.exe
2172	system.exe
1600	system.exe
1772	system.exe
3224	system.exe
4380	system.exe
232	system.exe
392	system.exe
2004	system.exe
3332	system.exe
1772	system.exe
3224	system.exe
228	system.exe
5028	system.exe
3744	system.exe
4872	system.exe
4088	system.exe
1320	system.exe
4276	system.exe
4380	system.exe
3432	system.exe
1516	system.exe
3916	system.exe
1464	system.exe
4664	system.exe
4088	system.exe
2812	system.exe
3304	system.exe
3716	system.exe
1744	system.exe
1600	system.exe
1592	system.exe
448	system.exe
1032	system.exe
3176	system.exe
4744	system.exe
2292	system.exe
3192	system.exe
3672	system.exe
4664	system.exe
1088	system.exe
2432	system.exe
2672	system.exe
1336	system.exe
1732	system.exe
1908	system.exe
2340	system.exe
2744	system.exe
4316	system.exe
2416	system.exe
4744	system.exe
3916	system.exe
4464	system.exe
4872	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systems = "C:\\Users\\Public\\Services\\system.exe"	system.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Public\Services\killer\desktop.ini	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4664	c5604fa1cf8d82960162ef353e072ee0N.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe
2260	system.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	system.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	c5604fa1cf8d82960162ef353e072ee0N.exe
Token: SeDebugPrivilege	2260	system.exe
Token: SeBackupPrivilege	828	dw20.exe
Token: SeBackupPrivilege	828	dw20.exe
Token: SeBackupPrivilege	4284	dw20.exe
Token: SeBackupPrivilege	4284	dw20.exe
Token: SeBackupPrivilege	4004	dw20.exe
Token: SeBackupPrivilege	4004	dw20.exe
Token: SeBackupPrivilege	1600	dw20.exe
Token: SeBackupPrivilege	1600	dw20.exe
Token: SeBackupPrivilege	4536	dw20.exe
Token: SeBackupPrivilege	4536	dw20.exe
Token: SeBackupPrivilege	2500	dw20.exe
Token: SeBackupPrivilege	2500	dw20.exe
Token: SeBackupPrivilege	1020	dw20.exe
Token: SeBackupPrivilege	1020	dw20.exe
Token: SeBackupPrivilege	3876	dw20.exe
Token: SeBackupPrivilege	3876	dw20.exe
Token: SeBackupPrivilege	4988	dw20.exe
Token: SeBackupPrivilege	4988	dw20.exe
Token: SeBackupPrivilege	4420	dw20.exe
Token: SeBackupPrivilege	4420	dw20.exe
Token: SeBackupPrivilege	4004	dw20.exe
Token: SeBackupPrivilege	4004	dw20.exe
Token: SeBackupPrivilege	5116	dw20.exe
Token: SeBackupPrivilege	5116	dw20.exe
Token: SeBackupPrivilege	4192	dw20.exe
Token: SeBackupPrivilege	4192	dw20.exe
Token: SeBackupPrivilege	2812	dw20.exe
Token: SeBackupPrivilege	2812	dw20.exe
Token: SeBackupPrivilege	4984	dw20.exe
Token: SeBackupPrivilege	4984	dw20.exe
Token: SeBackupPrivilege	2292	dw20.exe
Token: SeBackupPrivilege	2292	dw20.exe
Token: SeBackupPrivilege	876	dw20.exe
Token: SeBackupPrivilege	876	dw20.exe
Token: SeBackupPrivilege	1156	dw20.exe
Token: SeBackupPrivilege	1156	dw20.exe
Token: SeBackupPrivilege	1916	dw20.exe
Token: SeBackupPrivilege	1916	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	4704	dw20.exe
Token: SeBackupPrivilege	4704	dw20.exe
Token: SeBackupPrivilege	1460	dw20.exe
Token: SeBackupPrivilege	1460	dw20.exe
Token: SeBackupPrivilege	372	dw20.exe
Token: SeBackupPrivilege	372	dw20.exe
Token: SeBackupPrivilege	5108	dw20.exe
Token: SeBackupPrivilege	5108	dw20.exe
Token: SeBackupPrivilege	2172	dw20.exe
Token: SeBackupPrivilege	2172	dw20.exe
Token: SeBackupPrivilege	3332	dw20.exe
Token: SeBackupPrivilege	3332	dw20.exe
Token: SeBackupPrivilege	676	dw20.exe
Token: SeBackupPrivilege	676	dw20.exe
Token: SeBackupPrivilege	4636	dw20.exe
Token: SeBackupPrivilege	4636	dw20.exe
Token: SeBackupPrivilege	4744	dw20.exe
Token: SeBackupPrivilege	4744	dw20.exe
Token: SeBackupPrivilege	2128	dw20.exe
Token: SeBackupPrivilege	2128	dw20.exe
Token: SeBackupPrivilege	3744	dw20.exe
Token: SeBackupPrivilege	3744	dw20.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2260	4664	c5604fa1cf8d82960162ef353e072ee0N.exe	94
PID 4664 wrote to memory of 2260	4664	c5604fa1cf8d82960162ef353e072ee0N.exe	94
PID 2260 wrote to memory of 2832	2260	system.exe	95
PID 2260 wrote to memory of 2832	2260	system.exe	95
PID 2832 wrote to memory of 828	2832	system.exe	96
PID 2832 wrote to memory of 828	2832	system.exe	96
PID 2260 wrote to memory of 1728	2260	system.exe	98
PID 2260 wrote to memory of 1728	2260	system.exe	98
PID 1728 wrote to memory of 4284	1728	system.exe	99
PID 1728 wrote to memory of 4284	1728	system.exe	99
PID 2260 wrote to memory of 1464	2260	system.exe	102
PID 2260 wrote to memory of 1464	2260	system.exe	102
PID 1464 wrote to memory of 4004	1464	system.exe	103
PID 1464 wrote to memory of 4004	1464	system.exe	103
PID 2260 wrote to memory of 2284	2260	system.exe	104
PID 2260 wrote to memory of 2284	2260	system.exe	104
PID 2284 wrote to memory of 1600	2284	system.exe	105
PID 2284 wrote to memory of 1600	2284	system.exe	105
PID 2260 wrote to memory of 4540	2260	system.exe	106
PID 2260 wrote to memory of 4540	2260	system.exe	106
PID 4540 wrote to memory of 4536	4540	system.exe	108
PID 4540 wrote to memory of 4536	4540	system.exe	108
PID 2260 wrote to memory of 1916	2260	system.exe	110
PID 2260 wrote to memory of 1916	2260	system.exe	110
PID 1916 wrote to memory of 2500	1916	system.exe	111
PID 1916 wrote to memory of 2500	1916	system.exe	111
PID 2260 wrote to memory of 3212	2260	system.exe	112
PID 2260 wrote to memory of 3212	2260	system.exe	112
PID 3212 wrote to memory of 1020	3212	system.exe	113
PID 3212 wrote to memory of 1020	3212	system.exe	113
PID 2260 wrote to memory of 3928	2260	system.exe	114
PID 2260 wrote to memory of 3928	2260	system.exe	114
PID 3928 wrote to memory of 3876	3928	system.exe	115
PID 3928 wrote to memory of 3876	3928	system.exe	115
PID 2260 wrote to memory of 2832	2260	system.exe	116
PID 2260 wrote to memory of 2832	2260	system.exe	116
PID 2832 wrote to memory of 4988	2832	system.exe	117
PID 2832 wrote to memory of 4988	2832	system.exe	117
PID 2260 wrote to memory of 2004	2260	system.exe	118
PID 2260 wrote to memory of 2004	2260	system.exe	118
PID 2004 wrote to memory of 4420	2004	system.exe	119
PID 2004 wrote to memory of 4420	2004	system.exe	119
PID 2260 wrote to memory of 2172	2260	system.exe	120
PID 2260 wrote to memory of 2172	2260	system.exe	120
PID 2172 wrote to memory of 4004	2172	system.exe	121
PID 2172 wrote to memory of 4004	2172	system.exe	121
PID 2260 wrote to memory of 1600	2260	system.exe	122
PID 2260 wrote to memory of 1600	2260	system.exe	122
PID 1600 wrote to memory of 5116	1600	system.exe	123
PID 1600 wrote to memory of 5116	1600	system.exe	123
PID 2260 wrote to memory of 1772	2260	system.exe	142
PID 2260 wrote to memory of 1772	2260	system.exe	142
PID 1772 wrote to memory of 4192	1772	system.exe	126
PID 1772 wrote to memory of 4192	1772	system.exe	126
PID 2260 wrote to memory of 3224	2260	system.exe	144
PID 2260 wrote to memory of 3224	2260	system.exe	144
PID 3224 wrote to memory of 2812	3224	system.exe	128
PID 3224 wrote to memory of 2812	3224	system.exe	128
PID 2260 wrote to memory of 4380	2260	system.exe	129
PID 2260 wrote to memory of 4380	2260	system.exe	129
PID 4380 wrote to memory of 4984	4380	system.exe	130
PID 4380 wrote to memory of 4984	4380	system.exe	130
PID 2260 wrote to memory of 232	2260	system.exe	132
PID 2260 wrote to memory of 232	2260	system.exe	132

C:\Users\Admin\AppData\Local\Temp\c5604fa1cf8d82960162ef353e072ee0N.exe
"C:\Users\Admin\AppData\Local\Temp\c5604fa1cf8d82960162ef353e072ee0N.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Public\Services\system.exe
  "C:\Users\Public\Services\system.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:828
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 736
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4004
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:1600
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:1020
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4988
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4004
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:5116
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4192
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4984
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:232
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2292
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:392
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:876
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1156
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3332
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1772
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2340
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3224
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:228
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:1460
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:5028
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:372
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2172
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1320
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:676
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4276
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 736
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1516
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:3744
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3916
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2228
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1464
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3312
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2720
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Enumerates system info in registry
      PID:5116
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2812
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4276
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3304
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3704
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3716
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:392
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1608
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2500
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1592
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:804
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:448
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3044
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1032
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:5116
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3176
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:692
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      PID:2320
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2292
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 736
      4⤵
      PID:5028
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3192
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:3220
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3672
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:624
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:3044
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1088
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3224
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2416
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4744
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1336
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:2916
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1732
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:5056
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:1908
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      Checks processor information in registry
      PID:1592
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2340
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4704
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1568
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4316
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:376
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:2416
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:452
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:392
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:3916
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3992
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4464
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4320
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4776
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4712
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3044
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3876
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Checks processor information in registry
      PID:4952
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4888
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:948
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:620
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3456
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3224
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:5076
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:5028
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:2772
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:2284
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:804
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:3452
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4764
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3312
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3984
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3044
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4752
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:4256
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4736
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:4984
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4156
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4636
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1432
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:5076
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:832
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3780
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4024
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4540
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:2004
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2892
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 736
      4⤵
      Enumerates system info in registry
      PID:2332
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3300
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4712
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4400
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      PID:692
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4088
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2164
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4984
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:3512
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4580
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1784
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4800
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2412
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4680
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4460
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4172
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Enumerates system info in registry
      PID:876
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2916
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:4540
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1732
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:2004
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2340
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:4872
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:684
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1660
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:2208
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2432
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4904
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4256
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      PID:1648
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2132
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:2552
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1888
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2512
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4640
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      PID:1172
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:624
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4744
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4320
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1168
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2284
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2840
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2332
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      Checks processor information in registry
      PID:2636
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:228
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4276
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2580
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4304
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4100
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 756
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:2812
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:620
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:948
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4580
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4448
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2088
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4824
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4680
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:1156
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4024
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:1460
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4172
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3348
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4664
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:32
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2284
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4872
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:684
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1528
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2744
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2432
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:636
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4704
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Enumerates system info in registry
      PID:4316
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:620
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3008
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4448
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:4732
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2320
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:4640
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3816
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      PID:4444
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1460
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2084
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4420
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      PID:4608
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3696
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3928
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3432
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:684
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2248
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2208
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2164
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:636
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4116
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4704
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3316
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:1232
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4816
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4580
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4968
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2088
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1516
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:624
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:660
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3348
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1732
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3876
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3928
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3180
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3060
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2460
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:1800
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2208
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Checks processor information in registry
      PID:1008
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3512
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2816
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:5072
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      PID:3704
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1888
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 764
      4⤵
      PID:948
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:860
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:544
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4580
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3192
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1780
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:832
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3780
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3164
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2840
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:5100
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:648
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:180
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4608
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1732
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:1420
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3876
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:900
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1396
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4888
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1492
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4984
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2720
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:3260
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2816
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:2512
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1232
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2132
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4732
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      Enumerates system info in registry
      PID:2412
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1636
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2772
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4640
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:2564
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1780
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1652
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3780
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2084
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4212
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2256
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3452
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:4856
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4608
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2868
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3180
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3080
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4400
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1528
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3024
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      Enumerates system info in registry
      PID:5112
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4724
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2208
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2720
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      PID:4704
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3620
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2512
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4672
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      PID:4988
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2672
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      Checks processor information in registry
      PID:2412
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4816
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2772
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4580
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:2088
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3224
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1516
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1568
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1600
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2348
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:1916
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2332
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:5116
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4764
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:216
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1864
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:684
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2172
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4276
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1152
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3588
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1728
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:3512
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3456
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 764
      4⤵
      PID:2164
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4964
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:372
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3616
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4020
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4988
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      4⤵
      PID:2228
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1952
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:436
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:5008
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3816
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4580
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:3140
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:624
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:2116
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4292
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 128
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:2256
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2348
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:1116
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2332
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4608
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4764
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:2032
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3804
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      PID:1800
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2744
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      PID:4572
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1008
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 764
      4⤵
      PID:3844
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4760
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4156
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:3356
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4100
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:4652
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      PID:4536
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:620
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Enumerates system info in registry
      PID:2416
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:1172
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 744
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:1636
- - C:\Users\Public\Services\system.exe
    "C:\Users\Public\Services\system.exe" help
    3⤵
    PID:2320
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 748
      4⤵
      PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Services\all.cfg

Filesize
26B

MD5
a3aba13ba7d45d69e20a147e2b7a9162

SHA1
f483648c664fd8df0b88b91785e139299aafbe9e

SHA256
4c5bb87056c5521a5f341e5cf0dc5d776fad1749b387f9f31a3f3387c45d2895

SHA512
a8a4e9e479a736aa0839a0d1f21abcfab63f2a08c264635500e692ace533ab5faf99acefff3319a94d9755855c49e35b3524be7892521c26fb467eb09de18b43

Download Submit
C:\Users\Public\Services\system.exe

Filesize
85KB

MD5
c5604fa1cf8d82960162ef353e072ee0

SHA1
8748c8d9bd5aaa5d2037d1c92b84db048deb789f

SHA256
cdd3ecb63c30de836ab13f573ec82faa0688a3e5ea7e54d2178f984cf709c5c6

SHA512
f840219065d07fa9f5d49b30bd9a142ead388f3d0020a0359d1f0913c69c48792de0506864d91816601509cf9f4af9038e9c9921e70de3893101891c1a70a2f9

Download Submit
memory/2260-21-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/2260-145-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/2260-17-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/2260-19-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/2832-31-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/2832-24-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/4664-3-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/4664-18-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download
memory/4664-0-0x00007FFA25855000-0x00007FFA25856000-memory.dmp

Filesize
4KB

Download
memory/4664-2-0x000000001BD50000-0x000000001C21E000-memory.dmp

Filesize
4.8MB

Download
memory/4664-1-0x00007FFA255A0000-0x00007FFA25F41000-memory.dmp

Filesize
9.6MB

Download