metasploit | e8d610e3f2e1f74709b0ebd886acd017fd5d48fee94f50f04c3cab128ce3a345

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe
Size

214KB
MD5

c59d6896224266655faa7bdf6478ff08
SHA1

2453856bada31197671ce8d5c845169a185eb604
SHA256

e8d610e3f2e1f74709b0ebd886acd017fd5d48fee94f50f04c3cab128ce3a345
SHA512

6fe92cce102070e7b874f6d6405c6f9ae789f3bc083fc378905dd0517f0bf0779c48c0609facd5cd252653b6a2a55e27459b1a55caa275d73d6dfe5d9e131ede
SSDEEP

6144:JoW05D1fPM203JEIyCk4v9XeYQGpKBZsyYVJ1Fz:Jo/ZP03JEnfJYQkK9EJnz

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Deletes itself 1 IoCs

pid	Process
2220	wmitkfk.exe

Executes dropped EXE 64 IoCs

pid	Process
2384	wmitkfk.exe
2220	wmitkfk.exe
2728	wmitkfk.exe
2928	wmitkfk.exe
2628	wmitkfk.exe
1276	wmitkfk.exe
1600	wmitkfk.exe
2916	wmitkfk.exe
1468	wmitkfk.exe
2912	wmitkfk.exe
1652	wmitkfk.exe
1144	wmitkfk.exe
344	wmitkfk.exe
2204	wmitkfk.exe
2992	wmitkfk.exe
848	wmitkfk.exe
1028	wmitkfk.exe
1784	wmitkfk.exe
2492	wmitkfk.exe
2392	wmitkfk.exe
2380	wmitkfk.exe
608	wmitkfk.exe
1584	wmitkfk.exe
2972	wmitkfk.exe
2876	wmitkfk.exe
2084	wmitkfk.exe
2804	wmitkfk.exe
2644	wmitkfk.exe
2688	wmitkfk.exe
2684	wmitkfk.exe
840	wmitkfk.exe
1084	wmitkfk.exe
2952	wmitkfk.exe
2680	wmitkfk.exe
2024	wmitkfk.exe
1904	wmitkfk.exe
1140	wmitkfk.exe
1284	wmitkfk.exe
2208	wmitkfk.exe
1644	wmitkfk.exe
1596	wmitkfk.exe
2168	wmitkfk.exe
1668	wmitkfk.exe
1360	wmitkfk.exe
3044	wmitkfk.exe
564	wmitkfk.exe
2380	wmitkfk.exe
1768	wmitkfk.exe
1580	wmitkfk.exe
2072	wmitkfk.exe
2264	wmitkfk.exe
1964	wmitkfk.exe
2252	wmitkfk.exe
2824	wmitkfk.exe
316	wmitkfk.exe
2636	wmitkfk.exe
2200	wmitkfk.exe
2228	wmitkfk.exe
300	wmitkfk.exe
2924	wmitkfk.exe
2952	wmitkfk.exe
2712	wmitkfk.exe
2896	wmitkfk.exe
1752	wmitkfk.exe

Loads dropped DLL 64 IoCs

pid	Process
1720	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe
2384	wmitkfk.exe
2220	wmitkfk.exe
2928	wmitkfk.exe
1276	wmitkfk.exe
2916	wmitkfk.exe
2912	wmitkfk.exe
1144	wmitkfk.exe
2204	wmitkfk.exe
848	wmitkfk.exe
1784	wmitkfk.exe
2392	wmitkfk.exe
608	wmitkfk.exe
2972	wmitkfk.exe
2084	wmitkfk.exe
2644	wmitkfk.exe
2684	wmitkfk.exe
1084	wmitkfk.exe
2680	wmitkfk.exe
1904	wmitkfk.exe
1284	wmitkfk.exe
1644	wmitkfk.exe
2168	wmitkfk.exe
1360	wmitkfk.exe
564	wmitkfk.exe
1768	wmitkfk.exe
2072	wmitkfk.exe
1964	wmitkfk.exe
2824	wmitkfk.exe
2636	wmitkfk.exe
2228	wmitkfk.exe
2924	wmitkfk.exe
2712	wmitkfk.exe
1752	wmitkfk.exe
2196	wmitkfk.exe
2244	wmitkfk.exe
1512	wmitkfk.exe
1792	wmitkfk.exe
1532	wmitkfk.exe
2352	wmitkfk.exe
1556	wmitkfk.exe
2752	wmitkfk.exe
588	wmitkfk.exe
2652	wmitkfk.exe
1488	wmitkfk.exe
984	wmitkfk.exe
1908	wmitkfk.exe
344	wmitkfk.exe
444	wmitkfk.exe
1772	wmitkfk.exe
2976	wmitkfk.exe
1672	wmitkfk.exe
1584	wmitkfk.exe
1576	wmitkfk.exe
2728	wmitkfk.exe
2348	wmitkfk.exe
1476	wmitkfk.exe
2940	wmitkfk.exe
580	wmitkfk.exe
844	wmitkfk.exe
756	wmitkfk.exe
748	wmitkfk.exe
2504	wmitkfk.exe
2272	wmitkfk.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File opened for modification	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe
File created	C:\Windows\SysWOW64\wmitkfk.exe	wmitkfk.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 2384 set thread context of 2220	2384	wmitkfk.exe	32
PID 2728 set thread context of 2928	2728	wmitkfk.exe	34
PID 2628 set thread context of 1276	2628	wmitkfk.exe	36
PID 1600 set thread context of 2916	1600	wmitkfk.exe	38
PID 1468 set thread context of 2912	1468	wmitkfk.exe	40
PID 1652 set thread context of 1144	1652	wmitkfk.exe	42
PID 344 set thread context of 2204	344	wmitkfk.exe	45
PID 2992 set thread context of 848	2992	wmitkfk.exe	47
PID 1028 set thread context of 1784	1028	wmitkfk.exe	49
PID 2492 set thread context of 2392	2492	wmitkfk.exe	51
PID 2380 set thread context of 608	2380	wmitkfk.exe	53
PID 1584 set thread context of 2972	1584	wmitkfk.exe	55
PID 2876 set thread context of 2084	2876	wmitkfk.exe	57
PID 2804 set thread context of 2644	2804	wmitkfk.exe	59
PID 2688 set thread context of 2684	2688	wmitkfk.exe	61
PID 840 set thread context of 1084	840	wmitkfk.exe	63
PID 2952 set thread context of 2680	2952	wmitkfk.exe	65
PID 2024 set thread context of 1904	2024	wmitkfk.exe	67
PID 1140 set thread context of 1284	1140	wmitkfk.exe	69
PID 2208 set thread context of 1644	2208	wmitkfk.exe	71
PID 1596 set thread context of 2168	1596	wmitkfk.exe	73
PID 1668 set thread context of 1360	1668	wmitkfk.exe	75
PID 3044 set thread context of 564	3044	wmitkfk.exe	77
PID 2380 set thread context of 1768	2380	wmitkfk.exe	79
PID 1580 set thread context of 2072	1580	wmitkfk.exe	81
PID 2264 set thread context of 1964	2264	wmitkfk.exe	83
PID 2252 set thread context of 2824	2252	wmitkfk.exe	85
PID 316 set thread context of 2636	316	wmitkfk.exe	87
PID 2200 set thread context of 2228	2200	wmitkfk.exe	89
PID 300 set thread context of 2924	300	wmitkfk.exe	91
PID 2952 set thread context of 2712	2952	wmitkfk.exe	93
PID 2896 set thread context of 1752	2896	wmitkfk.exe	95
PID 2268 set thread context of 2196	2268	wmitkfk.exe	97
PID 404 set thread context of 2244	404	wmitkfk.exe	99
PID 1764 set thread context of 1512	1764	wmitkfk.exe	101
PID 696 set thread context of 1792	696	wmitkfk.exe	103
PID 2464 set thread context of 1532	2464	wmitkfk.exe	105
PID 1712 set thread context of 2352	1712	wmitkfk.exe	107
PID 2532 set thread context of 1556	2532	wmitkfk.exe	109
PID 2544 set thread context of 2752	2544	wmitkfk.exe	111
PID 2864 set thread context of 588	2864	wmitkfk.exe	113
PID 2184 set thread context of 2652	2184	wmitkfk.exe	115
PID 2656 set thread context of 1488	2656	wmitkfk.exe	117
PID 384 set thread context of 984	384	wmitkfk.exe	119
PID 832 set thread context of 1908	832	wmitkfk.exe	121
PID 2648 set thread context of 344	2648	wmitkfk.exe	123
PID 748 set thread context of 444	748	wmitkfk.exe	125
PID 2160 set thread context of 1772	2160	wmitkfk.exe	127
PID 1760 set thread context of 2976	1760	wmitkfk.exe	129
PID 1696 set thread context of 1672	1696	wmitkfk.exe	131
PID 1684 set thread context of 1584	1684	wmitkfk.exe	133
PID 2028 set thread context of 1576	2028	wmitkfk.exe	135
PID 2828 set thread context of 2728	2828	wmitkfk.exe	137
PID 316 set thread context of 2348	316	wmitkfk.exe	139
PID 2152 set thread context of 1476	2152	wmitkfk.exe	141
PID 1736 set thread context of 2940	1736	wmitkfk.exe	143
PID 1916 set thread context of 580	1916	wmitkfk.exe	145
PID 804 set thread context of 844	804	wmitkfk.exe	147
PID 2552 set thread context of 756	2552	wmitkfk.exe	149
PID 1636 set thread context of 748	1636	wmitkfk.exe	151
PID 404 set thread context of 2504	404	wmitkfk.exe	153
PID 2280 set thread context of 2272	2280	wmitkfk.exe	155
PID 1248 set thread context of 2988	1248	wmitkfk.exe	157

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1720-6-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-4-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-11-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-10-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-8-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-2-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-9-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-21-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2220-32-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2220-34-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2220-33-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2220-31-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2220-39-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2928-50-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2928-56-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1276-66-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1276-72-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2916-83-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2916-89-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2912-100-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2912-104-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1144-115-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1144-121-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2204-136-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/848-152-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1784-167-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2392-176-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2392-183-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/608-199-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2972-214-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2084-229-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2644-244-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2684-259-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1084-273-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2680-287-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1904-299-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1284-311-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1644-323-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2168-331-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2168-336-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1360-348-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/564-360-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1768-372-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2072-384-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1964-396-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2824-408-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2636-420-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2228-432-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2924-444-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2712-456-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1752-468-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2196-480-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2244-492-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1512-504-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1792-516-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1532-528-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2352-540-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1556-552-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2752-564-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/588-576-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2652-588-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1488-600-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/984-612-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1908-624-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmitkfk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe
2220	wmitkfk.exe
2928	wmitkfk.exe
1276	wmitkfk.exe
2916	wmitkfk.exe
2912	wmitkfk.exe
1144	wmitkfk.exe
2204	wmitkfk.exe
848	wmitkfk.exe
1784	wmitkfk.exe
2392	wmitkfk.exe
608	wmitkfk.exe
2972	wmitkfk.exe
2084	wmitkfk.exe
2644	wmitkfk.exe
2684	wmitkfk.exe
1084	wmitkfk.exe
2680	wmitkfk.exe
1904	wmitkfk.exe
1284	wmitkfk.exe
1644	wmitkfk.exe
2168	wmitkfk.exe
1360	wmitkfk.exe
564	wmitkfk.exe
1768	wmitkfk.exe
2072	wmitkfk.exe
1964	wmitkfk.exe
2824	wmitkfk.exe
2636	wmitkfk.exe
2228	wmitkfk.exe
2924	wmitkfk.exe
2712	wmitkfk.exe
1752	wmitkfk.exe
2196	wmitkfk.exe
2244	wmitkfk.exe
1512	wmitkfk.exe
1792	wmitkfk.exe
1532	wmitkfk.exe
2352	wmitkfk.exe
1556	wmitkfk.exe
2752	wmitkfk.exe
588	wmitkfk.exe
2652	wmitkfk.exe
1488	wmitkfk.exe
984	wmitkfk.exe
1908	wmitkfk.exe
344	wmitkfk.exe
444	wmitkfk.exe
1772	wmitkfk.exe
2976	wmitkfk.exe
1672	wmitkfk.exe
1584	wmitkfk.exe
1576	wmitkfk.exe
2728	wmitkfk.exe
2348	wmitkfk.exe
1476	wmitkfk.exe
2940	wmitkfk.exe
580	wmitkfk.exe
844	wmitkfk.exe
756	wmitkfk.exe
748	wmitkfk.exe
2504	wmitkfk.exe
2272	wmitkfk.exe
2988	wmitkfk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1720	2536	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	30
PID 1720 wrote to memory of 2384	1720	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2384	1720	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2384	1720	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2384	1720	c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2220	2384	wmitkfk.exe	32
PID 2384 wrote to memory of 2220	2384	wmitkfk.exe	32
PID 2384 wrote to memory of 2220	2384	wmitkfk.exe	32
PID 2384 wrote to memory of 2220	2384	wmitkfk.exe	32
PID 2384 wrote to memory of 2220	2384	wmitkfk.exe	32
PID 2384 wrote to memory of 2220	2384	wmitkfk.exe	32
PID 2384 wrote to memory of 2220	2384	wmitkfk.exe	32
PID 2220 wrote to memory of 2728	2220	wmitkfk.exe	33
PID 2220 wrote to memory of 2728	2220	wmitkfk.exe	33
PID 2220 wrote to memory of 2728	2220	wmitkfk.exe	33
PID 2220 wrote to memory of 2728	2220	wmitkfk.exe	33
PID 2728 wrote to memory of 2928	2728	wmitkfk.exe	34
PID 2728 wrote to memory of 2928	2728	wmitkfk.exe	34
PID 2728 wrote to memory of 2928	2728	wmitkfk.exe	34
PID 2728 wrote to memory of 2928	2728	wmitkfk.exe	34
PID 2728 wrote to memory of 2928	2728	wmitkfk.exe	34
PID 2728 wrote to memory of 2928	2728	wmitkfk.exe	34
PID 2728 wrote to memory of 2928	2728	wmitkfk.exe	34
PID 2928 wrote to memory of 2628	2928	wmitkfk.exe	35
PID 2928 wrote to memory of 2628	2928	wmitkfk.exe	35
PID 2928 wrote to memory of 2628	2928	wmitkfk.exe	35
PID 2928 wrote to memory of 2628	2928	wmitkfk.exe	35
PID 2628 wrote to memory of 1276	2628	wmitkfk.exe	36
PID 2628 wrote to memory of 1276	2628	wmitkfk.exe	36
PID 2628 wrote to memory of 1276	2628	wmitkfk.exe	36
PID 2628 wrote to memory of 1276	2628	wmitkfk.exe	36
PID 2628 wrote to memory of 1276	2628	wmitkfk.exe	36
PID 2628 wrote to memory of 1276	2628	wmitkfk.exe	36
PID 2628 wrote to memory of 1276	2628	wmitkfk.exe	36
PID 1276 wrote to memory of 1600	1276	wmitkfk.exe	37
PID 1276 wrote to memory of 1600	1276	wmitkfk.exe	37
PID 1276 wrote to memory of 1600	1276	wmitkfk.exe	37
PID 1276 wrote to memory of 1600	1276	wmitkfk.exe	37
PID 1600 wrote to memory of 2916	1600	wmitkfk.exe	38
PID 1600 wrote to memory of 2916	1600	wmitkfk.exe	38
PID 1600 wrote to memory of 2916	1600	wmitkfk.exe	38
PID 1600 wrote to memory of 2916	1600	wmitkfk.exe	38
PID 1600 wrote to memory of 2916	1600	wmitkfk.exe	38
PID 1600 wrote to memory of 2916	1600	wmitkfk.exe	38
PID 1600 wrote to memory of 2916	1600	wmitkfk.exe	38
PID 2916 wrote to memory of 1468	2916	wmitkfk.exe	39
PID 2916 wrote to memory of 1468	2916	wmitkfk.exe	39
PID 2916 wrote to memory of 1468	2916	wmitkfk.exe	39
PID 2916 wrote to memory of 1468	2916	wmitkfk.exe	39
PID 1468 wrote to memory of 2912	1468	wmitkfk.exe	40
PID 1468 wrote to memory of 2912	1468	wmitkfk.exe	40
PID 1468 wrote to memory of 2912	1468	wmitkfk.exe	40
PID 1468 wrote to memory of 2912	1468	wmitkfk.exe	40
PID 1468 wrote to memory of 2912	1468	wmitkfk.exe	40
PID 1468 wrote to memory of 2912	1468	wmitkfk.exe	40
PID 1468 wrote to memory of 2912	1468	wmitkfk.exe	40
PID 2912 wrote to memory of 1652	2912	wmitkfk.exe	41
PID 2912 wrote to memory of 1652	2912	wmitkfk.exe	41

C:\Users\Admin\AppData\Local\Temp\c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c59d6896224266655faa7bdf6478ff08_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\wmitkfk.exe
    "C:\Windows\system32\wmitkfk.exe" C:\Users\Admin\AppData\Local\Temp\C59D68~1.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\wmitkfk.exe
      "C:\Windows\SysWOW64\wmitkfk.exe" C:\Users\Admin\AppData\Local\Temp\C59D68~1.EXE
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2220
    - - C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2728
      - C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1652
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1144
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:344
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2204
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:848
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1028
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1784
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2492
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2392
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2380
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:608
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1584
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2972
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2876
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2084
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2804
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2644
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2688
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2684
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:840
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        34⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1084
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2952
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        36⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2680
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2024
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1904
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1140
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1284
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        42⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1644
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2168
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1668
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        46⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1360
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3044
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        48⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:564
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2380
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1768
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1580
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        52⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2072
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2264
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        54⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1964
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2252
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2824
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:316
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        58⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2636
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2200
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        60⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2228
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:300
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        62⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2924
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        63⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2952
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        64⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2712
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        65⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2896
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        66⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1752
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        67⤵
        Suspicious use of SetThreadContext
        
        PID:2268
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        68⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2196
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        69⤵
        Suspicious use of SetThreadContext
        
        PID:404
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        70⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2244
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        71⤵
        Suspicious use of SetThreadContext
        
        PID:1764
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        72⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1512
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        73⤵
        Suspicious use of SetThreadContext
        
        PID:696
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        74⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1792
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        75⤵
        Suspicious use of SetThreadContext
        
        PID:2464
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        76⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        77⤵
        Suspicious use of SetThreadContext
        
        PID:1712
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        78⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2352
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        79⤵
        Suspicious use of SetThreadContext
        
        PID:2532
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        80⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1556
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        81⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        82⤵
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2752
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        83⤵
        Suspicious use of SetThreadContext
        
        PID:2864
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        84⤵
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:588
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        85⤵
        Suspicious use of SetThreadContext
        
        PID:2184
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        86⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2652
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        87⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        88⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1488
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        89⤵
        Suspicious use of SetThreadContext
        
        PID:384
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        90⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:984
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        91⤵
        Suspicious use of SetThreadContext
        
        PID:832
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        92⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1908
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        93⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        94⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:344
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        95⤵
        Suspicious use of SetThreadContext
        
        PID:748
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        96⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:444
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        97⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        98⤵
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1772
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        99⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        100⤵
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2976
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        101⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        102⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1672
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        103⤵
        Suspicious use of SetThreadContext
        
        PID:1684
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        104⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1584
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        105⤵
        Suspicious use of SetThreadContext
        
        PID:2028
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        106⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        107⤵
        Suspicious use of SetThreadContext
        
        PID:2828
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        108⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2728
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        109⤵
        Suspicious use of SetThreadContext
        
        PID:316
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        110⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2348
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        111⤵
        Suspicious use of SetThreadContext
        
        PID:2152
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        112⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1476
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        113⤵
        Suspicious use of SetThreadContext
        
        PID:1736
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        114⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2940
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        115⤵
        Suspicious use of SetThreadContext
        
        PID:1916
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        116⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:580
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        117⤵
        Suspicious use of SetThreadContext
        
        PID:804
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        118⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:844
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        119⤵
        Suspicious use of SetThreadContext
        
        PID:2552
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        120⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:756
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        121⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        122⤵
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:748
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        123⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        124⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2504
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        125⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2280
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        126⤵
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        127⤵
        Suspicious use of SetThreadContext
        
        PID:1248
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        128⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2988
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        129⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        130⤵
        Drops file in System32 directory
        
        PID:2528
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        134⤵
        Drops file in System32 directory
        
        PID:2816
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        135⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        136⤵
        Drops file in System32 directory
        
        PID:2688
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        137⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        138⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        140⤵
        Drops file in System32 directory
        
        PID:1952
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        141⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        142⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        144⤵
        Drops file in System32 directory
        
        PID:2172
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        146⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        148⤵
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        150⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        151⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        152⤵
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        153⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        155⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        156⤵
        Drops file in System32 directory
        
        PID:2696
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        157⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        160⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        162⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        163⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        164⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        165⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        166⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        168⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        169⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        170⤵
        Drops file in System32 directory
        
        PID:2336
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        171⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        174⤵
        Drops file in System32 directory
        
        PID:2472
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        175⤵
        
        PID:540
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        176⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        177⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        178⤵
        Drops file in System32 directory
        
        PID:1032
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        180⤵
        Drops file in System32 directory
        
        PID:1944
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        181⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        182⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        183⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        184⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        185⤵
        
        PID:316
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        186⤵
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        190⤵
        
        PID:384
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        191⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        192⤵
        Drops file in System32 directory
        
        PID:2444
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        193⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        194⤵
        Drops file in System32 directory
        
        PID:2588
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        195⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        196⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        199⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\system32\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        C:\Windows\SysWOW64\wmitkfk.exe
        
        "C:\Windows\SysWOW64\wmitkfk.exe" C:\Windows\SysWOW64\wmitkfk.exe
        202⤵
        
        PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wmitkfk.exe

Filesize
214KB

MD5
c59d6896224266655faa7bdf6478ff08

SHA1
2453856bada31197671ce8d5c845169a185eb604

SHA256
e8d610e3f2e1f74709b0ebd886acd017fd5d48fee94f50f04c3cab128ce3a345

SHA512
6fe92cce102070e7b874f6d6405c6f9ae789f3bc083fc378905dd0517f0bf0779c48c0609facd5cd252653b6a2a55e27459b1a55caa275d73d6dfe5d9e131ede

Download Submit
memory/344-636-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/444-648-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/564-360-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/580-768-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/588-576-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/608-199-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/748-804-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/756-792-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/844-780-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/848-152-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/880-997-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/984-612-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1072-925-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1084-273-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1144-121-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1144-115-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1276-66-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1276-72-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1284-311-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1340-901-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1360-348-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1476-744-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1488-600-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1508-973-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1512-504-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1532-528-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1556-552-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1576-708-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1584-696-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1644-323-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1672-684-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-8-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-9-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-6-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-10-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-21-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-11-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-4-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1752-468-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1768-372-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1772-660-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1784-167-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1792-516-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1904-299-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1908-624-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1952-913-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1964-396-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2072-384-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2084-229-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2144-1081-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2168-331-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2168-336-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2172-937-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2196-480-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2204-136-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2220-31-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2220-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2220-34-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2220-39-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2220-32-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2228-432-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2236-961-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2244-492-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2272-828-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2308-985-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2336-1094-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2336-1089-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2348-732-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2352-540-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2392-183-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2392-176-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2436-1057-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2500-1021-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2504-816-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2528-852-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2620-1033-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2636-420-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2644-244-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2652-588-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2680-287-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2684-259-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2688-889-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2692-864-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2696-1009-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2712-456-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2728-720-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2736-949-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2752-564-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2808-1045-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2816-873-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2816-877-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2824-408-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2892-1069-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2912-100-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2912-104-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2916-83-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2916-89-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2924-444-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2928-50-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2928-56-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2940-756-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2972-214-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2976-672-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2988-840-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download