1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HEUR-Trojan-Ransom.Win32.PornoAsset.exe
Size

627KB
MD5

6528aeb4bc362743ae95a66ccfbdaf8b
SHA1

1f9397b14eed25d1d138ec6259f95c8646e8cb92
SHA256

1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739
SHA512

62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74
SSDEEP

12288:or3TTrym3e1k7weffYuKm5PScLLgMK1NJbChWI:oT/X3vMeXYuKuSsLg31NNPI

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe dxnote32.exe"	dxnote32.exe

Executes dropped EXE 64 IoCs

pid	Process
1316	dxnote32.exe
896	dxnote32.exe
1780	dxnote32.exe
796	dxnote32.exe
972	dxnote32.exe
520	dxnote32.exe
1616	dxnote32.exe
1192	dxnote32.exe
1188	dxnote32.exe
1140	dxnote32.exe
1728	dxnote32.exe
1708	dxnote32.exe
1776	dxnote32.exe
976	dxnote32.exe
1880	dxnote32.exe
304	dxnote32.exe
1672	dxnote32.exe
1940	dxnote32.exe
1612	dxnote32.exe
1720	dxnote32.exe
1312	dxnote32.exe
1744	dxnote32.exe
2032	dxnote32.exe
1692	dxnote32.exe
1408	dxnote32.exe
852	dxnote32.exe
1532	dxnote32.exe
756	dxnote32.exe
560	dxnote32.exe
1704	dxnote32.exe
1308	dxnote32.exe
1756	dxnote32.exe
1604	dxnote32.exe
892	dxnote32.exe
944	dxnote32.exe
556	dxnote32.exe
108	dxnote32.exe
364	dxnote32.exe
808	dxnote32.exe
1892	dxnote32.exe
616	dxnote32.exe
1588	dxnote32.exe
1732	dxnote32.exe
1996	dxnote32.exe
1900	dxnote32.exe
268	dxnote32.exe
1092	dxnote32.exe
1224	dxnote32.exe
956	dxnote32.exe
2000	dxnote32.exe
1476	dxnote32.exe
1516	dxnote32.exe
936	dxnote32.exe
1404	dxnote32.exe
1624	dxnote32.exe
824	dxnote32.exe
1440	dxnote32.exe
1908	dxnote32.exe
884	dxnote32.exe
1148	dxnote32.exe
1340	dxnote32.exe
820	dxnote32.exe
1928	dxnote32.exe
2016	dxnote32.exe

Loads dropped DLL 64 IoCs

pid	Process
1556	HEUR-Trojan-Ransom.Win32.PornoAsset.exe
1556	HEUR-Trojan-Ransom.Win32.PornoAsset.exe
1316	dxnote32.exe
1316	dxnote32.exe
896	dxnote32.exe
896	dxnote32.exe
1780	dxnote32.exe
1780	dxnote32.exe
796	dxnote32.exe
796	dxnote32.exe
972	dxnote32.exe
972	dxnote32.exe
520	dxnote32.exe
520	dxnote32.exe
1616	dxnote32.exe
1616	dxnote32.exe
1192	dxnote32.exe
1192	dxnote32.exe
1188	dxnote32.exe
1188	dxnote32.exe
1140	dxnote32.exe
1140	dxnote32.exe
1728	dxnote32.exe
1728	dxnote32.exe
1708	dxnote32.exe
1708	dxnote32.exe
1776	dxnote32.exe
1776	dxnote32.exe
976	dxnote32.exe
976	dxnote32.exe
1880	dxnote32.exe
1880	dxnote32.exe
304	dxnote32.exe
304	dxnote32.exe
1672	dxnote32.exe
1672	dxnote32.exe
1940	dxnote32.exe
1940	dxnote32.exe
1612	dxnote32.exe
1612	dxnote32.exe
1720	dxnote32.exe
1720	dxnote32.exe
1312	dxnote32.exe
1312	dxnote32.exe
1744	dxnote32.exe
1744	dxnote32.exe
2032	dxnote32.exe
2032	dxnote32.exe
1692	dxnote32.exe
1692	dxnote32.exe
1408	dxnote32.exe
1408	dxnote32.exe
852	dxnote32.exe
852	dxnote32.exe
1532	dxnote32.exe
1532	dxnote32.exe
756	dxnote32.exe
756	dxnote32.exe
560	dxnote32.exe
560	dxnote32.exe
1704	dxnote32.exe
1704	dxnote32.exe
1308	dxnote32.exe
1308	dxnote32.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dxnote32 = "C:\\Windows\\system32\\dxnote32.exe"	dxnote32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File created	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe
File opened for modification	C:\Windows\SysWOW64\dxnote32.exe	dxnote32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1316	1556	HEUR-Trojan-Ransom.Win32.PornoAsset.exe	27
PID 1556 wrote to memory of 1316	1556	HEUR-Trojan-Ransom.Win32.PornoAsset.exe	27
PID 1556 wrote to memory of 1316	1556	HEUR-Trojan-Ransom.Win32.PornoAsset.exe	27
PID 1556 wrote to memory of 1316	1556	HEUR-Trojan-Ransom.Win32.PornoAsset.exe	27
PID 1316 wrote to memory of 896	1316	dxnote32.exe	28
PID 1316 wrote to memory of 896	1316	dxnote32.exe	28
PID 1316 wrote to memory of 896	1316	dxnote32.exe	28
PID 1316 wrote to memory of 896	1316	dxnote32.exe	28
PID 896 wrote to memory of 1780	896	dxnote32.exe	29
PID 896 wrote to memory of 1780	896	dxnote32.exe	29
PID 896 wrote to memory of 1780	896	dxnote32.exe	29
PID 896 wrote to memory of 1780	896	dxnote32.exe	29
PID 1780 wrote to memory of 796	1780	dxnote32.exe	30
PID 1780 wrote to memory of 796	1780	dxnote32.exe	30
PID 1780 wrote to memory of 796	1780	dxnote32.exe	30
PID 1780 wrote to memory of 796	1780	dxnote32.exe	30
PID 796 wrote to memory of 972	796	dxnote32.exe	31
PID 796 wrote to memory of 972	796	dxnote32.exe	31
PID 796 wrote to memory of 972	796	dxnote32.exe	31
PID 796 wrote to memory of 972	796	dxnote32.exe	31
PID 972 wrote to memory of 520	972	dxnote32.exe	32
PID 972 wrote to memory of 520	972	dxnote32.exe	32
PID 972 wrote to memory of 520	972	dxnote32.exe	32
PID 972 wrote to memory of 520	972	dxnote32.exe	32
PID 520 wrote to memory of 1616	520	dxnote32.exe	33
PID 520 wrote to memory of 1616	520	dxnote32.exe	33
PID 520 wrote to memory of 1616	520	dxnote32.exe	33
PID 520 wrote to memory of 1616	520	dxnote32.exe	33
PID 1616 wrote to memory of 1192	1616	dxnote32.exe	34
PID 1616 wrote to memory of 1192	1616	dxnote32.exe	34
PID 1616 wrote to memory of 1192	1616	dxnote32.exe	34
PID 1616 wrote to memory of 1192	1616	dxnote32.exe	34
PID 1192 wrote to memory of 1188	1192	dxnote32.exe	35
PID 1192 wrote to memory of 1188	1192	dxnote32.exe	35
PID 1192 wrote to memory of 1188	1192	dxnote32.exe	35
PID 1192 wrote to memory of 1188	1192	dxnote32.exe	35
PID 1188 wrote to memory of 1140	1188	dxnote32.exe	36
PID 1188 wrote to memory of 1140	1188	dxnote32.exe	36
PID 1188 wrote to memory of 1140	1188	dxnote32.exe	36
PID 1188 wrote to memory of 1140	1188	dxnote32.exe	36
PID 1140 wrote to memory of 1728	1140	dxnote32.exe	37
PID 1140 wrote to memory of 1728	1140	dxnote32.exe	37
PID 1140 wrote to memory of 1728	1140	dxnote32.exe	37
PID 1140 wrote to memory of 1728	1140	dxnote32.exe	37
PID 1728 wrote to memory of 1708	1728	dxnote32.exe	38
PID 1728 wrote to memory of 1708	1728	dxnote32.exe	38
PID 1728 wrote to memory of 1708	1728	dxnote32.exe	38
PID 1728 wrote to memory of 1708	1728	dxnote32.exe	38
PID 1708 wrote to memory of 1776	1708	dxnote32.exe	39
PID 1708 wrote to memory of 1776	1708	dxnote32.exe	39
PID 1708 wrote to memory of 1776	1708	dxnote32.exe	39
PID 1708 wrote to memory of 1776	1708	dxnote32.exe	39
PID 1776 wrote to memory of 976	1776	dxnote32.exe	40
PID 1776 wrote to memory of 976	1776	dxnote32.exe	40
PID 1776 wrote to memory of 976	1776	dxnote32.exe	40
PID 1776 wrote to memory of 976	1776	dxnote32.exe	40
PID 976 wrote to memory of 1880	976	dxnote32.exe	41
PID 976 wrote to memory of 1880	976	dxnote32.exe	41
PID 976 wrote to memory of 1880	976	dxnote32.exe	41
PID 976 wrote to memory of 1880	976	dxnote32.exe	41
PID 1880 wrote to memory of 304	1880	dxnote32.exe	42
PID 1880 wrote to memory of 304	1880	dxnote32.exe	42
PID 1880 wrote to memory of 304	1880	dxnote32.exe	42
PID 1880 wrote to memory of 304	1880	dxnote32.exe	42

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.PornoAsset.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.PornoAsset.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\dxnote32.exe
  "C:\Windows\system32\dxnote32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\SysWOW64\dxnote32.exe
    "C:\Windows\system32\dxnote32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\SysWOW64\dxnote32.exe
      "C:\Windows\system32\dxnote32.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:796
      - C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:520
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        11⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        14⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:304
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1940
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        20⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1612
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1720
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1312
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1744
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2032
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1692
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1408
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:852
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        28⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:756
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:560
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        31⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1704
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1308
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        33⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        34⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1604
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        35⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        36⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        
        PID:944
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        37⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        38⤵
        Executes dropped EXE
        
        PID:108
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        39⤵
        Executes dropped EXE
        
        PID:364
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:808
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        41⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1892
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        42⤵
        Executes dropped EXE
        
        PID:616
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        43⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        44⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1732
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        45⤵
        Executes dropped EXE
        
        PID:1996
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        46⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1900
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        47⤵
        Executes dropped EXE
        
        PID:268
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        48⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        49⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        50⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:956
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        51⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        52⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        53⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        54⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:936
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        55⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        56⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1624
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        57⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        58⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        59⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        60⤵
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        61⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1148
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1340
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        63⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:820
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        64⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        65⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        66⤵
        Adds Run key to start application
        
        PID:1548
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        67⤵
        Modifies WinLogon for persistence
        
        PID:1572
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        68⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:1028
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        69⤵
        
        PID:924
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        70⤵
        
        PID:948
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        71⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        72⤵
        Drops file in System32 directory
        
        PID:600
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        73⤵
        Adds Run key to start application
        
        PID:1248
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        74⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:2040
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        75⤵
        Modifies WinLogon for persistence
        
        PID:1800
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        76⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        77⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:1596
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        78⤵
        Modifies WinLogon for persistence
        
        PID:1536
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        79⤵
        Drops file in System32 directory
        
        PID:792
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        80⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        81⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        82⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        83⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        84⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        85⤵
        
        PID:684
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        86⤵
        Drops file in System32 directory
        
        PID:2012
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        87⤵
        
        PID:468
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        88⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:1772
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        89⤵
        Adds Run key to start application
        
        PID:296
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        90⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:624
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        91⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:788
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        92⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        93⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        94⤵
        Adds Run key to start application
        
        PID:1528
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        95⤵
        
        PID:580
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        96⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        97⤵
        Adds Run key to start application
        
        PID:1564
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        98⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        99⤵
        Modifies WinLogon for persistence
        
        PID:1348
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        100⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        101⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        102⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:1296
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        103⤵
        
        PID:284
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        104⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:1088
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        105⤵
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        106⤵
        Modifies WinLogon for persistence
        
        PID:1064
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        107⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:864
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        108⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        109⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        110⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        111⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        112⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        113⤵
        Adds Run key to start application
        
        PID:1600
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        114⤵
        Drops file in System32 directory
        
        PID:1320
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        115⤵
        Modifies WinLogon for persistence
        
        PID:920
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        116⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        117⤵
        Adds Run key to start application
        
        PID:568
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        118⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        119⤵
        
        PID:996
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        120⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:1240
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        121⤵
        Adds Run key to start application
        
        PID:672
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        122⤵
        Adds Run key to start application
        
        PID:1204
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        123⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        124⤵
        Drops file in System32 directory
        
        PID:280
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        125⤵
        Modifies WinLogon for persistence
        
        PID:1948
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        126⤵
        
        PID:988
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        127⤵
        Adds Run key to start application
        
        PID:1696
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        128⤵
        
        PID:836
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        129⤵
        Drops file in System32 directory
        
        PID:968
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        130⤵
        Modifies WinLogon for persistence
        
        PID:1656
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        131⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        132⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        133⤵
        Adds Run key to start application
        
        PID:1944
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        134⤵
        Modifies WinLogon for persistence
        
        PID:860
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        135⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:768
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        136⤵
        Drops file in System32 directory
        
        PID:544
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        137⤵
        Drops file in System32 directory
        
        PID:980
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        138⤵
        
        PID:960
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        139⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        140⤵
        Adds Run key to start application
        
        PID:832
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        141⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        142⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:1492
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        143⤵
        Modifies WinLogon for persistence
        
        PID:1032
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        144⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:1912
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        145⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        146⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        147⤵
        Modifies WinLogon for persistence
        
        PID:1888
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        148⤵
        Modifies WinLogon for persistence
        
        PID:1084
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        149⤵
        Modifies WinLogon for persistence
        
        PID:1472
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        150⤵
        Drops file in System32 directory
        
        PID:764
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        151⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        152⤵
        
        PID:284
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        153⤵
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        154⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        155⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        156⤵
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        157⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        158⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        159⤵
        Drops file in System32 directory
        
        PID:2224
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        160⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2264
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        161⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        162⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        163⤵
        Drops file in System32 directory
        
        PID:2396
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        164⤵
        Modifies WinLogon for persistence
        
        PID:2440
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        165⤵
        Adds Run key to start application
        
        PID:2484
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        166⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2524
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        167⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        168⤵
        Drops file in System32 directory
        
        PID:2608
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        169⤵
        Drops file in System32 directory
        
        PID:2652
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        170⤵
        Modifies WinLogon for persistence
        
        PID:2696
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        171⤵
        Drops file in System32 directory
        
        PID:2740
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        172⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2784
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        173⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        174⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2872
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        175⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        176⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        177⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        178⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3048
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        179⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:828
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        180⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        181⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        182⤵
        Adds Run key to start application
        
        PID:2160
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        183⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        184⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        185⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        186⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        187⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        188⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2476
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        189⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        190⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2560
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        191⤵
        Adds Run key to start application
        
        PID:2604
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        192⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        193⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        194⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        195⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        196⤵
        Drops file in System32 directory
        
        PID:2804
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        197⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2884
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        198⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:1060
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        199⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        200⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1144
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        201⤵
        Modifies WinLogon for persistence
        
        PID:1096
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        202⤵
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        203⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2096
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        204⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        205⤵
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        206⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        207⤵
        Adds Run key to start application
        
        PID:2320
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        208⤵
        Modifies WinLogon for persistence
        
        PID:2376
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        209⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        210⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        211⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        212⤵
        Drops file in System32 directory
        
        PID:2620
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        213⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        214⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        215⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        216⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2816
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        217⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        218⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        219⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        220⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        221⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        222⤵
        Drops file in System32 directory
        
        PID:1176
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        223⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        224⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        225⤵
        Modifies WinLogon for persistence
        
        PID:2228
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        226⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        227⤵
        Adds Run key to start application
        
        PID:2340
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        228⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        229⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        230⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        231⤵
        Adds Run key to start application
        
        PID:2588
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        232⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        233⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2640
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        234⤵
        Modifies WinLogon for persistence
        
        PID:2808
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        235⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        236⤵
        Adds Run key to start application
        
        PID:2900
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        237⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        238⤵
        Modifies WinLogon for persistence
        
        PID:3036
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        239⤵
        Modifies WinLogon for persistence
        
        PID:3040
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        240⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        241⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2100
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        242⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        243⤵
        Drops file in System32 directory
        
        PID:2240
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        244⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        245⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        246⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        247⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        248⤵
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        249⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        250⤵
        Adds Run key to start application
        
        PID:2736
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        251⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        252⤵
        Drops file in System32 directory
        
        PID:2728
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        253⤵
        Modifies WinLogon for persistence
        
        PID:2892
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        254⤵
        Drops file in System32 directory
        
        PID:2868
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        255⤵
        Modifies WinLogon for persistence
        
        PID:2976
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        256⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2940
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        257⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        258⤵
        Adds Run key to start application
        
        PID:3068
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        259⤵
        Adds Run key to start application
        
        PID:2204
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        260⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        261⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        262⤵
        Drops file in System32 directory
        
        PID:2412
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        263⤵
        Modifies WinLogon for persistence
        
        PID:2480
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        264⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        265⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        266⤵
        Modifies WinLogon for persistence
        
        PID:2720
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        267⤵
        Modifies WinLogon for persistence
        
        PID:2796
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        268⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2820
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        269⤵
        Drops file in System32 directory
        
        PID:1160
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        270⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        271⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        272⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:2196
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        273⤵
        Adds Run key to start application
        
        PID:2180
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        274⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        275⤵
        Adds Run key to start application
        
        PID:2344
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        276⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\dxnote32.exe
        
        "C:\Windows\system32\dxnote32.exe"
        277⤵
        
        PID:2500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
C:\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
\Windows\SysWOW64\dxnote32.exe

Filesize
627KB

MD5
6528aeb4bc362743ae95a66ccfbdaf8b

SHA1
1f9397b14eed25d1d138ec6259f95c8646e8cb92

SHA256
1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

SHA512
62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

Download Submit
memory/108-176-0x0000000000000000-mapping.dmp

Download
memory/268-194-0x0000000000000000-mapping.dmp

Download
memory/304-133-0x0000000000000000-mapping.dmp

Download
memory/364-178-0x0000000000000000-mapping.dmp

Download
memory/520-83-0x0000000000000000-mapping.dmp

Download
memory/556-174-0x0000000000000000-mapping.dmp

Download
memory/560-160-0x0000000000000000-mapping.dmp

Download
memory/616-184-0x0000000000000000-mapping.dmp

Download
memory/756-158-0x0000000000000000-mapping.dmp

Download
memory/796-73-0x0000000000000000-mapping.dmp

Download
memory/808-180-0x0000000000000000-mapping.dmp

Download
memory/820-226-0x0000000000000000-mapping.dmp

Download
memory/824-214-0x0000000000000000-mapping.dmp

Download
memory/852-154-0x0000000000000000-mapping.dmp

Download
memory/884-220-0x0000000000000000-mapping.dmp

Download
memory/892-170-0x0000000000000000-mapping.dmp

Download
memory/896-63-0x0000000000000000-mapping.dmp

Download
memory/936-208-0x0000000000000000-mapping.dmp

Download
memory/944-172-0x0000000000000000-mapping.dmp

Download
memory/956-200-0x0000000000000000-mapping.dmp

Download
memory/972-78-0x0000000000000000-mapping.dmp

Download
memory/976-123-0x0000000000000000-mapping.dmp

Download
memory/1092-196-0x0000000000000000-mapping.dmp

Download
memory/1140-103-0x0000000000000000-mapping.dmp

Download
memory/1148-222-0x0000000000000000-mapping.dmp

Download
memory/1188-98-0x0000000000000000-mapping.dmp

Download
memory/1192-93-0x0000000000000000-mapping.dmp

Download
memory/1224-198-0x0000000000000000-mapping.dmp

Download
memory/1308-164-0x0000000000000000-mapping.dmp

Download
memory/1312-144-0x0000000000000000-mapping.dmp

Download
memory/1316-57-0x0000000000000000-mapping.dmp

Download
memory/1340-224-0x0000000000000000-mapping.dmp

Download
memory/1404-210-0x0000000000000000-mapping.dmp

Download
memory/1408-152-0x0000000000000000-mapping.dmp

Download
memory/1440-216-0x0000000000000000-mapping.dmp

Download
memory/1476-204-0x0000000000000000-mapping.dmp

Download
memory/1516-206-0x0000000000000000-mapping.dmp

Download
memory/1532-156-0x0000000000000000-mapping.dmp

Download
memory/1556-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1588-186-0x0000000000000000-mapping.dmp

Download
memory/1604-168-0x0000000000000000-mapping.dmp

Download
memory/1612-140-0x0000000000000000-mapping.dmp

Download
memory/1616-88-0x0000000000000000-mapping.dmp

Download
memory/1624-212-0x0000000000000000-mapping.dmp

Download
memory/1672-136-0x0000000000000000-mapping.dmp

Download
memory/1692-150-0x0000000000000000-mapping.dmp

Download
memory/1704-162-0x0000000000000000-mapping.dmp

Download
memory/1708-113-0x0000000000000000-mapping.dmp

Download
memory/1720-142-0x0000000000000000-mapping.dmp

Download
memory/1728-108-0x0000000000000000-mapping.dmp

Download
memory/1732-188-0x0000000000000000-mapping.dmp

Download
memory/1744-146-0x0000000000000000-mapping.dmp

Download
memory/1756-166-0x0000000000000000-mapping.dmp

Download
memory/1776-118-0x0000000000000000-mapping.dmp

Download
memory/1780-68-0x0000000000000000-mapping.dmp

Download
memory/1880-128-0x0000000000000000-mapping.dmp

Download
memory/1892-182-0x0000000000000000-mapping.dmp

Download
memory/1900-192-0x0000000000000000-mapping.dmp

Download
memory/1908-218-0x0000000000000000-mapping.dmp

Download
memory/1928-228-0x0000000000000000-mapping.dmp

Download
memory/1940-138-0x0000000000000000-mapping.dmp

Download
memory/1996-190-0x0000000000000000-mapping.dmp

Download
memory/2000-202-0x0000000000000000-mapping.dmp

Download
memory/2016-230-0x0000000000000000-mapping.dmp

Download
memory/2032-148-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads