Overview

overview

7

Static

static

3

09ec2458a7...0e.exe

windows7-x64

6

09ec2458a7...0e.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    22s
  • max time network
    71s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 01:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    09ec2458a746ed795c88a62729a3d30e.exe

  • Size

    46KB

  • MD5

    09ec2458a746ed795c88a62729a3d30e

  • SHA1

    750cbd39b147e19cd38c6cf305487ee7d25243d8

  • SHA256

    c6e1325d7043ee9af9529565e9a2ac16d56c2f1f8365d1dd469a0d3ea497c62a

  • SHA512

    8e96b91af9e65097c41f4edade11219962220418a770d57977fe979bd2c50fe505f8eac367de22c53c9b4baf11cbac73d5a6d5f2190f3e70d672cfbc5402fca4

  • SSDEEP

    768:j7RNHmpC97r/hgGxtPuC+uwkIuIe98PXs4/wKUUpWL9Sfc3VkX0BoEoc5un:j7x97r/doawVur4YKUOWxVFIi5un

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 62 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09ec2458a746ed795c88a62729a3d30e.exe
    "C:\Users\Admin\AppData\Local\Temp\09ec2458a746ed795c88a62729a3d30e.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\WINDOWS\SysWOW64\gcasServ32.exe
      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\USERS\ADMIN\APPDATA\LOCAL\TEMP\09EC2458A746ED795C88A62729A3D30E.EXE
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\WINDOWS\SysWOW64\jhxwxwhqxx.exe
        "C:\WINDOWS\SYSTEM32\jhxwxwhqxx.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3336
  • C:\WINDOWS\SysWOW64\mommyooluq.exe
    "C:\WINDOWS\SYSTEM32\mommyooluq.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Adds Run key to start application
    • Modifies registry class
    PID:544
    • C:\WINDOWS\SysWOW64\xjnefipiib.exe
      "C:\WINDOWS\SYSTEM32\xjnefipiib.exe" mElTC:\WINDOWS\SYSWOW64\MOMMYOOLUQ.EXE
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\WINDOWS\SysWOW64\gcasServ32.exe
        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\XJNEFIPIIB.EXE
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\WINDOWS\SysWOW64\gfphpphxby.exe
          "C:\WINDOWS\SYSTEM32\gfphpphxby.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3616
  • C:\WINDOWS\SysWOW64\gcasServ32.exe
    "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\UZNBBMJTYV.EXE
    1⤵
      PID:3964
    • C:\WINDOWS\SysWOW64\tagaswzgsg.exe
      "C:\WINDOWS\SYSTEM32\tagaswzgsg.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1584
      • C:\WINDOWS\SysWOW64\gcasServ32.exe
        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\TAGASWZGSG.EXE
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2212
    • C:\WINDOWS\SysWOW64\gcasServ32.exe
      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\RFFNKQROHD.EXE
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\WINDOWS\SysWOW64\oumndxevin.exe
        "C:\WINDOWS\SYSTEM32\oumndxevin.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1560
    • C:\WINDOWS\SysWOW64\eatiwrfkqk.exe
      "C:\WINDOWS\SYSTEM32\eatiwrfkqk.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\WINDOWS\SysWOW64\gcasServ32.exe
        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\EATIWRFKQK.EXE
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\WINDOWS\SysWOW64\wzwgnwjxys.exe
          "C:\WINDOWS\SYSTEM32\wzwgnwjxys.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\WINDOWS\SysWOW64\gvxycrrdmd.exe
            "C:\WINDOWS\SYSTEM32\gvxycrrdmd.exe" mElTC:\WINDOWS\SYSWOW64\WZWGNWJXYS.EXE
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            PID:880
            • C:\WINDOWS\SysWOW64\gcasServ32.exe
              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\GVXYCRRDMD.EXE
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • Modifies registry class
              PID:3136
    • C:\WINDOWS\SysWOW64\yymjebcszz.exe
      "C:\WINDOWS\SYSTEM32\yymjebcszz.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      PID:4420
      • C:\WINDOWS\SysWOW64\gcasServ32.exe
        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\YYMJEBCSZZ.EXE
        2⤵
          PID:100
      • C:\WINDOWS\SysWOW64\rvluskgdvm.exe
        "C:\WINDOWS\SYSTEM32\rvluskgdvm.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        PID:2408
        • C:\WINDOWS\SysWOW64\gcasServ32.exe
          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\RVLUSKGDVM.EXE
          2⤵
            PID:3016
            • C:\WINDOWS\SysWOW64\jjlepllvig.exe
              "C:\WINDOWS\SYSTEM32\jjlepllvig.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
              3⤵
                PID:4524
                • C:\WINDOWS\SysWOW64\rkkedaprjq.exe
                  "C:\WINDOWS\SYSTEM32\rkkedaprjq.exe" mElTC:\WINDOWS\SYSWOW64\JJLEPLLVIG.EXE
                  4⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies registry class
                  PID:1892
                  • C:\WINDOWS\SysWOW64\gcasServ32.exe
                    "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\RKKEDAPRJQ.EXE
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies registry class
                    PID:884
                    • C:\WINDOWS\SysWOW64\lepuvtxows.exe
                      "C:\WINDOWS\SYSTEM32\lepuvtxows.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                      6⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • Modifies registry class
                      PID:3500
                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\LEPUVTXOWS.EXE
                        7⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Modifies registry class
                        PID:5100
                        • C:\WINDOWS\SysWOW64\jjoponyvmp.exe
                          "C:\WINDOWS\SYSTEM32\jjoponyvmp.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                          8⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Modifies registry class
                          PID:4428
                          • C:\WINDOWS\SysWOW64\gcasServ32.exe
                            "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\JJOPONYVMP.EXE
                            9⤵
                              PID:4524
                              • C:\WINDOWS\SysWOW64\gdkdeieiam.exe
                                "C:\WINDOWS\SYSTEM32\gdkdeieiam.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                10⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Modifies registry class
                                PID:1932
                                • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                  "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\GDKDEIEIAM.EXE
                                  11⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Modifies registry class
                                  PID:3400
                                  • C:\WINDOWS\SysWOW64\weevfmknig.exe
                                    "C:\WINDOWS\SYSTEM32\weevfmknig.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Drops file in System32 directory
                                    • Modifies registry class
                                    PID:3380
                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\WEEVFMKNIG.EXE
                                      13⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Drops file in System32 directory
                                      • Modifies registry class
                                      PID:1220
                                      • C:\WINDOWS\SysWOW64\tjlqxgkvpd.exe
                                        "C:\WINDOWS\SYSTEM32\tjlqxgkvpd.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in System32 directory
                                        • Modifies registry class
                                        PID:4592
                                        • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\TJLQXGKVPD.EXE
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Drops file in System32 directory
                                          • Modifies registry class
                                          PID:676
                                          • C:\WINDOWS\SysWOW64\jcjqtbseyp.exe
                                            "C:\WINDOWS\SYSTEM32\jcjqtbseyp.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                            16⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Drops file in System32 directory
                                            • Modifies registry class
                                            PID:1996
                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\JCJQTBSEYP.EXE
                                              17⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Drops file in System32 directory
                                              • Modifies registry class
                                              PID:3024
                                              • C:\WINDOWS\SysWOW64\yohwwcfmsw.exe
                                                "C:\WINDOWS\SYSTEM32\yohwwcfmsw.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                18⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Drops file in System32 directory
                                                • Modifies registry class
                                                PID:2704
                                                • C:\WINDOWS\SysWOW64\tfjzmrgots.exe
                                                  "C:\WINDOWS\SYSTEM32\tfjzmrgots.exe" mElTC:\WINDOWS\SYSWOW64\YOHWWCFMSW.EXE
                                                  19⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:4556
                                                  • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                    "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\TFJZMRGOTS.EXE
                                                    20⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Drops file in System32 directory
                                                    • Modifies registry class
                                                    PID:4648
                                                    • C:\WINDOWS\SysWOW64\mnmjcsfkif.exe
                                                      "C:\WINDOWS\SYSTEM32\mnmjcsfkif.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                      21⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Drops file in System32 directory
                                                      • Modifies registry class
                                                      PID:636
                                                      • C:\WINDOWS\SysWOW64\qdreyyrnpb.exe
                                                        "C:\WINDOWS\SYSTEM32\qdreyyrnpb.exe" mElTC:\WINDOWS\SYSWOW64\MNMJCSFKIF.EXE
                                                        22⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Modifies registry class
                                                        PID:3788
                                                        • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\QDREYYRNPB.EXE
                                                          23⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Drops file in System32 directory
                                                          • Modifies registry class
                                                          PID:4148
                                                          • C:\WINDOWS\SysWOW64\mraheqzeyi.exe
                                                            "C:\WINDOWS\SYSTEM32\mraheqzeyi.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                            24⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            PID:2436
                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\MRAHEQZEYI.EXE
                                                              25⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              PID:2396
                                                              • C:\WINDOWS\SysWOW64\gicctfahzw.exe
                                                                "C:\WINDOWS\SYSTEM32\gicctfahzw.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                26⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Drops file in System32 directory
                                                                • Modifies registry class
                                                                PID:5096
                                                                • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                  "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\GICCTFAHZW.EXE
                                                                  27⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Drops file in System32 directory
                                                                  • Modifies registry class
                                                                  PID:4368
                                                                  • C:\WINDOWS\SysWOW64\onlqrfhsud.exe
                                                                    "C:\WINDOWS\SYSTEM32\onlqrfhsud.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                    28⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    • Modifies registry class
                                                                    PID:3016
                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\ONLQRFHSUD.EXE
                                                                      29⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • Drops file in System32 directory
                                                                      • Modifies registry class
                                                                      PID:4412
                                                                      • C:\WINDOWS\SysWOW64\dkuvpfovpc.exe
                                                                        "C:\WINDOWS\SYSTEM32\dkuvpfovpc.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                        30⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Drops file in System32 directory
                                                                        • Modifies registry class
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3964
                                                                        • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\DKUVPFOVPC.EXE
                                                                          31⤵
                                                                            PID:3880
                                                                            • C:\WINDOWS\SysWOW64\wgmomgtodx.exe
                                                                              "C:\WINDOWS\SYSTEM32\wgmomgtodx.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                              32⤵
                                                                                PID:1100
                                                                                • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                  "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\WGMOMGTODX.EXE
                                                                                  33⤵
                                                                                    PID:4908
                                                                                    • C:\WINDOWS\SysWOW64\rxoqjvcqet.exe
                                                                                      "C:\WINDOWS\SYSTEM32\rxoqjvcqet.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                      34⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      PID:3300
                                                                                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\RXOQJVCQET.EXE
                                                                                        35⤵
                                                                                          PID:4608
                                                                                          • C:\WINDOWS\SysWOW64\wkieoemqta.exe
                                                                                            "C:\WINDOWS\SYSTEM32\wkieoemqta.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                            36⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • Drops file in System32 directory
                                                                                            • Modifies registry class
                                                                                            PID:208
                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\WKIEOEMQTA.EXE
                                                                                              37⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • Drops file in System32 directory
                                                                                              • Modifies registry class
                                                                                              PID:3464
                                                                                              • C:\WINDOWS\SysWOW64\vrihkhxnwj.exe
                                                                                                "C:\WINDOWS\SYSTEM32\vrihkhxnwj.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                38⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                • Modifies registry class
                                                                                                PID:3140
                                                                                                • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                  "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\VRIHKHXNWJ.EXE
                                                                                                  39⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies registry class
                                                                                                  PID:5008
                                                                                                  • C:\WINDOWS\SysWOW64\jionsjpual.exe
                                                                                                    "C:\WINDOWS\SYSTEM32\jionsjpual.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                    40⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies registry class
                                                                                                    PID:4608
                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\JIONSJPUAL.EXE
                                                                                                      41⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Adds Run key to start application
                                                                                                      • Drops file in System32 directory
                                                                                                      • Modifies registry class
                                                                                                      PID:3960
                                                                                                      • C:\WINDOWS\SysWOW64\wwpaehwpxu.exe
                                                                                                        "C:\WINDOWS\SYSTEM32\wwpaehwpxu.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                        42⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Adds Run key to start application
                                                                                                        • Drops file in System32 directory
                                                                                                        • Modifies registry class
                                                                                                        PID:1200
                                                                                                        • C:\WINDOWS\SysWOW64\quyvgflpxr.exe
                                                                                                          "C:\WINDOWS\SYSTEM32\quyvgflpxr.exe" mElTC:\WINDOWS\SYSWOW64\WWPAEHWPXU.EXE
                                                                                                          43⤵
                                                                                                            PID:1944
                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\QUYVGFLPXR.EXE
                                                                                                              44⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in System32 directory
                                                                                                              • Modifies registry class
                                                                                                              PID:3880
                                                                                                              • C:\WINDOWS\SysWOW64\qvjgyzypaz.exe
                                                                                                                "C:\WINDOWS\SYSTEM32\qvjgyzypaz.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                45⤵
                                                                                                                  PID:4004
                                                                                                                  • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                    "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\QVJGYZYPAZ.EXE
                                                                                                                    46⤵
                                                                                                                      PID:100
                                                                                                                      • C:\WINDOWS\SysWOW64\whmzwqfgke.exe
                                                                                                                        "C:\WINDOWS\SYSTEM32\whmzwqfgke.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                        47⤵
                                                                                                                          PID:3324
                                                                                                                          • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                            "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\WHMZWQFGKE.EXE
                                                                                                                            48⤵
                                                                                                                              PID:4436
                                                                                                                              • C:\WINDOWS\SysWOW64\otcpkhnnzy.exe
                                                                                                                                "C:\WINDOWS\SYSTEM32\otcpkhnnzy.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                49⤵
                                                                                                                                  PID:3668
                                                                                                                                  • C:\WINDOWS\SysWOW64\izqazzwjts.exe
                                                                                                                                    "C:\WINDOWS\SYSTEM32\izqazzwjts.exe" mElTC:\WINDOWS\SYSWOW64\OTCPKHNNZY.EXE
                                                                                                                                    50⤵
                                                                                                                                      PID:4672
                                                                                                                                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\IZQAZZWJTS.EXE
                                                                                                                                        51⤵
                                                                                                                                          PID:512
                                                                                                                                          • C:\WINDOWS\SysWOW64\ihqdwcpowb.exe
                                                                                                                                            "C:\WINDOWS\SYSTEM32\ihqdwcpowb.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                            52⤵
                                                                                                                                              PID:1720
                                                                                                                                              • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\IHQDWCPOWB.EXE
                                                                                                                                                53⤵
                                                                                                                                                  PID:2212
                                                                                                                                                  • C:\WINDOWS\SysWOW64\vxwjeezvad.exe
                                                                                                                                                    "C:\WINDOWS\SYSTEM32\vxwjeezvad.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                    54⤵
                                                                                                                                                      PID:4728
                                                                                                                                                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\VXWJEEZVAD.EXE
                                                                                                                                                        55⤵
                                                                                                                                                          PID:2016
                                                                                                                                                          • C:\WINDOWS\SysWOW64\nmxrfamwxi.exe
                                                                                                                                                            "C:\WINDOWS\SYSTEM32\nmxrfamwxi.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                            56⤵
                                                                                                                                                              PID:4564
                                                                                                                                                              • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\NMXRFAMWXI.EXE
                                                                                                                                                                57⤵
                                                                                                                                                                  PID:1944
                                                                                                                                                                  • C:\WINDOWS\SysWOW64\tdefzvaiab.exe
                                                                                                                                                                    "C:\WINDOWS\SYSTEM32\tdefzvaiab.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                    58⤵
                                                                                                                                                                      PID:1148
                                                                                                                                                                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\TDEFZVAIAB.EXE
                                                                                                                                                                        59⤵
                                                                                                                                                                          PID:3780
                                                                                                                                                                          • C:\WINDOWS\SysWOW64\ahyiwasowi.exe
                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\ahyiwasowi.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                            60⤵
                                                                                                                                                                              PID:2844
                                                                                                                                                                              • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\AHYIWASOWI.EXE
                                                                                                                                                                                61⤵
                                                                                                                                                                                  PID:3768
                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\qtggwiiffd.exe
                                                                                                                                                                                    "C:\WINDOWS\SYSTEM32\qtggwiiffd.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                    62⤵
                                                                                                                                                                                      PID:4356
                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\QTGGWIIFFD.EXE
                                                                                                                                                                                        63⤵
                                                                                                                                                                                          PID:3816
                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\atvggbufjs.exe
                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\atvggbufjs.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                            64⤵
                                                                                                                                                                                              PID:2452
                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\ATVGGBUFJS.EXE
                                                                                                                                                                                                65⤵
                                                                                                                                                                                                  PID:664
                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\pftzkyqsgz.exe
                                                                                                                                                                                                    "C:\WINDOWS\SYSTEM32\pftzkyqsgz.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    PID:4524
                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\PFTZKYQSGZ.EXE
                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\liiahztyrf.exe
                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\liiahztyrf.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                            PID:3952
                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\LIIAHZTYRF.EXE
                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                PID:2668
                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\igqgmfeemw.exe
                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\igqgmfeemw.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                    PID:1868
                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\fsmbkikjtt.exe
                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\fsmbkikjtt.exe" mElTC:\WINDOWS\SYSWOW64\IGQGMFEEMW.EXE
                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                        PID:2212
                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\FSMBKIKJTT.EXE
                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\nhigifrtvt.exe
                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\nhigifrtvt.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                                PID:4068
                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\NHIGIFRTVT.EXE
                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                    PID:4004
                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\pgybzjkfda.exe
                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\pgybzjkfda.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                                        PID:4400
                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\npibnikpxk.exe
                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\npibnikpxk.exe" mElTC:\WINDOWS\SYSWOW64\PGYBZJKFDA.EXE
                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\NPIBNIKPXK.EXE
                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\pkvxfpuzob.exe
                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\pkvxfpuzob.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                    PID:4040
                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\PKVXFPUZOB.EXE
                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                        PID:516
                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cbsxbkopxx.exe
                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\cbsxbkopxx.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                            PID:3868
                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\CBSXBKOPXX.EXE
                                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                                PID:4940
                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cfonviarnb.exe
                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\cfonviarnb.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                    PID:1968
                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\CFONVIARNB.EXE
                                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\ftrwqxixjw.exe
                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\ftrwqxixjw.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\FTRWQXIXJW.EXE
                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\ucmbdbtumo.exe
                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\ucmbdbtumo.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\UCMBDBTUMO.EXE
                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\ksjnjnkrjx.exe
                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\ksjnjnkrjx.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                            PID:1584
                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\KSJNJNKRJX.EXE
                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                PID:2444
                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\xybvjdtmdp.exe
                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\xybvjdtmdp.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                    "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\XYBVJDTMDP.EXE
                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                      PID:2776
                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\ukxizgzzrn.exe
                                                                                                                                                                                                                                                                                                        "C:\WINDOWS\SYSTEM32\ukxizgzzrn.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                          PID:5040
                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\UKXIZGZZRN.EXE
                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                              PID:2952
                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\ssiqueyjtx.exe
                                                                                                                                                                                                                                                                                                                "C:\WINDOWS\SYSTEM32\ssiqueyjtx.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                    "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\SSIQUEYJTX.EXE
                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                      PID:3896
                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\xczqwjkgvj.exe
                                                                                                                                                                                                                                                                                                                        "C:\WINDOWS\SYSTEM32\xczqwjkgvj.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\XCZQWJKGVJ.EXE
                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                              PID:920
                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\uovwgyacqs.exe
                                                                                                                                                                                                                                                                                                                                "C:\WINDOWS\SYSTEM32\uovwgyacqs.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                  PID:4068
                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\xjyttmudyz.exe
                                                                                                                                                                                                                                                                                                                                    "C:\WINDOWS\SYSTEM32\xjyttmudyz.exe" mElTC:\WINDOWS\SYSWOW64\UOVWGYACQS.EXE
                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                      PID:664
                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\XJYTTMUDYZ.EXE
                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\zbzwxhibzx.exe
                                                                                                                                                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\zbzwxhibzx.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                              PID:4692
                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\ZBZWXHIBZX.EXE
                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2352
                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\fzgcqdondq.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\WINDOWS\SYSTEM32\fzgcqdondq.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\FZGCQDONDQ.EXE
                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                        PID:1100
                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\hywktpfzyv.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\hywktpfzyv.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2952
                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\HYWKTPFZYV.EXE
                                                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                                                                PID:372
                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cxnlobwebz.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\cxnlobwebz.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3896
                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\CXNLOBWEBZ.EXE
                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\rrtedjfdqw.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\rrtedjfdqw.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\RRTEDJFDQW.EXE
                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3816
                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\hzqpjnwavn.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\hzqpjnwavn.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3932
                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\wwzuhnddqu.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\wwzuhnddqu.exe" mElTC:\WINDOWS\SYSWOW64\HZQPJNWAVN.EXE
                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\WWZUHNDDQU.EXE
                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\jzinktunzb.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\jzinktunzb.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\JZINKTUNZB.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\rggybqhodi.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\rggybqhodi.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:896
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\RGGYBQHODI.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\urhtzgwvla.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\urhtzgwvla.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\URHTZGWVLA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\uohkwwcscd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\uohkwwcscd.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\klqxuwjdxc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\klqxuwjdxc.exe" mElTC:\WINDOWS\SYSWOW64\UOHKWWCSCD.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\KLQXUWJDXC.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:376
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\evskrmyknt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\evskrmyknt.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\EVSKRMYKNT.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\mzddufgrcp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\mzddufgrcp.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\MZDDUFGRCP.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\endnrglkqc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\endnrglkqc.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\ENDNRGLKQC.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\obfqsnwysy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\obfqsnwysy.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\OBFQSNWYSY.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\rbwjcezfnt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\rbwjcezfnt.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\RBWJCEZFNT.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\mwbrcyicbu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\mwbrcyicbu.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\MWBRCYICBU.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\mwcwoxfuva.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\WINDOWS\SYSTEM32\mwcwoxfuva.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\MWCWOXFUVA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\OUMNDXEVIN.EXE
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\rffnkqrohd.exe
                                                                                                                                                                                                          "C:\WINDOWS\SYSTEM32\rffnkqrohd.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                              "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\CLYXBIKXQH.EXE
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                              PID:3896
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\ZUQXXYJHSR.EXE
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:5004
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\zuqxxyjhsr.exe
                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\zuqxxyjhsr.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:2140
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\clyxbikxqh.exe
                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\clyxbikxqh.exe" mElTC:\WINDOWS\SYSWOW64\GCASSERV32.EXE
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\gcasServ32.exe" mElTC:\WINDOWS\SYSWOW64\GFPHPPHXBY.EXE
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:1636
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\uznbbmjtyv.exe
                                                                                                                                                                                                            "C:\WINDOWS\SYSTEM32\uznbbmjtyv.exe" mElTC:\WINDOWS\SYSWOW64\JHXWXWHQXX.EXE
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                          • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                                            C:\Windows\System32\sihclient.exe /cv CudE699NOEmF9gRhJ/7ylQ.0.2
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:100

                                                                                                                                                                                                          Network

                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                          • C:\Windows\SysWOW64\gcasServ32.exe
                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            46KB

                                                                                                                                                                                                            MD5

                                                                                                                                                                                                            09ec2458a746ed795c88a62729a3d30e

                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                            750cbd39b147e19cd38c6cf305487ee7d25243d8

                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                            c6e1325d7043ee9af9529565e9a2ac16d56c2f1f8365d1dd469a0d3ea497c62a

                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                            8e96b91af9e65097c41f4edade11219962220418a770d57977fe979bd2c50fe505f8eac367de22c53c9b4baf11cbac73d5a6d5f2190f3e70d672cfbc5402fca4

                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                          • memory/100-1032-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/100-998-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/100-991-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/544-194-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/868-6-0x0000000002290000-0x0000000002291000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/868-1-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/868-40-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/868-0-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/868-2-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/880-912-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/880-876-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/880-872-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/884-1182-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/884-1185-0x0000000000490000-0x0000000000491000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/884-1220-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-595-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-362-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-594-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-633-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-599-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-399-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-363-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/980-365-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1560-678-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1560-714-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1584-521-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1584-552-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1616-873-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1616-837-0x00000000004D0000-0x00000000004D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1632-798-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1632-834-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1632-791-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1636-328-0x0000000000590000-0x0000000000591000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1636-323-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1636-360-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1636-322-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1892-1181-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/1892-1149-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2132-793-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2132-756-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2140-475-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2140-445-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2140-441-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2140-440-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2212-560-0x00000000006E0000-0x00000000006E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2212-593-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2212-554-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2212-555-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2408-1071-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2408-1031-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2408-1037-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2908-42-0x0000000000500000-0x0000000000501000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2908-39-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2908-78-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/2908-38-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3016-1109-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3016-1070-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3016-1075-0x0000000000500000-0x0000000000501000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3136-954-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3136-911-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3136-918-0x0000000000600000-0x0000000000601000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3336-79-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3336-83-0x0000000000510000-0x0000000000511000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3336-116-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3336-77-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3484-244-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3484-245-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3484-248-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3484-281-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3616-289-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3616-321-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3616-284-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3616-285-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3780-205-0x00000000006E0000-0x00000000006E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3780-195-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3780-196-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3780-242-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3896-400-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3896-401-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3896-406-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3896-437-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3964-193-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3964-156-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3964-162-0x0000000000830000-0x0000000000831000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/3964-157-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4084-718-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4084-709-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4084-754-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4108-154-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4108-119-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4108-123-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4108-118-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4132-636-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4132-674-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4420-958-0x00000000006E0000-0x00000000006E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4420-993-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4524-1145-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/4524-1112-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/5004-483-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/5004-514-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/5004-477-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download

                                                                                                                                                                                                          • memory/5004-478-0x0000000000400000-0x00000000004655C0-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            405KB

                                                                                                                                                                                                            Download