cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
Size 29KB
Sample260925-xdqsrstglc
SHA256 cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04
MD5 9ec06c20cc9c39ef5e04011da0622e6b
SHA1 a375405845e66292eb511eee3e29beb8ace56450
SHA512 2f7bd960bf7d79c8feef3f111ec47417d1e6c83ec215718db9dde4aaff39cffd7c54d5c8cc63e903737c7fbaffb3cd6a20f35c2fe98c764948d0a1e6e3eb532f
SSDEEP 768:b0NbTbHCVklgq4UtHKBqOEdkL2FikxbJe+QP:bsz+klz4ksXP
TLSH
T192D22B47675444F2D2EB4674B6520F3B9FBE88743B91E4A7C7335BC29CA42D2A534207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4832	DiskMan32.exe
3340	msfkan.exe
1616	odjemy.exe
2304	roukpw.exe
884	oednne.exe
1236	oenoyb.exe
4280	tvesxi.exe
4928	wnhyag.exe
220	onrzkd.exe
1076	txlkdc.exe
3348	zocoks.exe
3940	bcrhim.exe
2568	gtikpc.exe
4532	yxgyxu.exe
4256	dopcvc.exe
2872	jfgfck.exe
5284	lwhmdq.exe
5468	oswfjs.exe
5640	ivzquv.exe
5804	nifoqg.exe
5392	qwuawb.exe
3832	nunqaj.exe
5608	qxyclm.exe
5604	qcnfgz.exe
5720	vsejeo.exe
1620	vpcxmh.exe
5732	uxlywe.exe
2828	aocbvm.exe
6240	ubrubo.exe
6396	apxlfr.exe
6616	zxhmio.exe
6776	enqpow.exe
6936	hnqvxc.exe
7144	esvutg.exe
6320	kfbkpr.exe
4572	gougjf.exe
4104	oeupgw.exe
4440	rsjiey.exe
6160	mcuoho.exe
6420	onyztz.exe
4124	twpdsg.exe
1680	ulzzuq.exe
1128	ttaaen.exe
5192	otaynu.exe
7184	tzquor.exe
7348	ymwlsd.exe
7504	ymxmds.exe
7660	dzdkzd.exe
7820	yvsvff.exe
7984	yryjmy.exe
8148	dmsaok.exe
7260	izyyso.exe
6428	ccbjvy.exe
7788	drlfxi.exe
8024	doktfb.exe
752	ibpkje.exe
4984	axxqwd.exe
5824	vxahcr.exe
6712	ufjimo.exe
1136	cjyeha.exe
4728	zsrzto.exe
1316	xnzduk.exe
4904	sbyufh.exe
5932	xvslpt.exe

Loads dropped DLL 64 IoCs

pid	Process
4168	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4832	DiskMan32.exe
3340	msfkan.exe
1616	odjemy.exe
2304	roukpw.exe
884	oednne.exe
1236	oenoyb.exe
4280	tvesxi.exe
4928	wnhyag.exe
220	onrzkd.exe
1076	txlkdc.exe
3348	zocoks.exe
3940	bcrhim.exe
2568	gtikpc.exe
4532	yxgyxu.exe
4256	dopcvc.exe
2872	jfgfck.exe
5284	lwhmdq.exe
5468	oswfjs.exe
5640	ivzquv.exe
5804	nifoqg.exe
5392	qwuawb.exe
3832	nunqaj.exe
5608	qxyclm.exe
5604	qcnfgz.exe
5720	vsejeo.exe
1620	vpcxmh.exe
5732	uxlywe.exe
2828	aocbvm.exe
6240	ubrubo.exe
6396	apxlfr.exe
6616	zxhmio.exe
6776	enqpow.exe
6936	hnqvxc.exe
7144	esvutg.exe
6320	kfbkpr.exe
4572	gougjf.exe
4104	oeupgw.exe
4440	rsjiey.exe
6160	mcuoho.exe
6420	onyztz.exe
4124	twpdsg.exe
1680	ulzzuq.exe
1128	ttaaen.exe
5192	otaynu.exe
7184	tzquor.exe
7348	ymwlsd.exe
7504	ymxmds.exe
7660	dzdkzd.exe
7820	yvsvff.exe
7984	yryjmy.exe
8148	dmsaok.exe
7260	izyyso.exe
6428	ccbjvy.exe
7788	drlfxi.exe
8024	doktfb.exe
752	ibpkje.exe
4984	axxqwd.exe
5824	vxahcr.exe
6712	ufjimo.exe
1136	cjyeha.exe
4728	zsrzto.exe
1316	xnzduk.exe
4904	sbyufh.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\bpubrf.exe"	xvslpt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\buspyy.exe"	bpubrf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\gbpzta.exe"	gmflrq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\enqpow.exe"	zxhmio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\otaynu.exe"	ttaaen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\zsrzto.exe"	cjyeha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\bcrhim.exe"	zocoks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\onyztz.exe"	mcuoho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\bvnhal.exe"	wihiea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\msfkan.exe"	DiskMan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\odjemy.exe"	msfkan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\nifoqg.exe"	ivzquv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\zxhmio.exe"	apxlfr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\eunfjj.exe"	bvnhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\onrzkd.exe"	wnhyag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\oeupgw.exe"	gougjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\rsjiey.exe"	oeupgw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ymwlsd.exe"	tzquor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\sbyufh.exe"	xnzduk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\drlfxi.exe"	ccbjvy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\yryjmy.exe"	yvsvff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\oswfjs.exe"	lwhmdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\kfbkpr.exe"	esvutg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\gougjf.exe"	kfbkpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ymxmds.exe"	ymwlsd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\gjxiqr.exe"	gbpzta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\txlkdc.exe"	onrzkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\esvutg.exe"	hnqvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\qxyclm.exe"	nunqaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\qcnfgz.exe"	qxyclm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\mcuoho.exe"	rsjiey.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\gmflrq.exe"	eunfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\apxlfr.exe"	ubrubo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\hnqvxc.exe"	enqpow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\yvsvff.exe"	dzdkzd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\wihiea.exe"	buspyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\oednne.exe"	roukpw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ufjimo.exe"	vxahcr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\uxlywe.exe"	vpcxmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\tvesxi.exe"	oenoyb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\vpcxmh.exe"	vsejeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ubrubo.exe"	aocbvm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ulzzuq.exe"	twpdsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\wnhyag.exe"	tvesxi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\nunqaj.exe"	qwuawb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ibpkje.exe"	doktfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\oenoyb.exe"	oednne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\vsejeo.exe"	qcnfgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\axxqwd.exe"	ibpkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\cjyeha.exe"	ufjimo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\xnzduk.exe"	zsrzto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\doktfb.exe"	drlfxi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\dmsaok.exe"	yryjmy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\izyyso.exe"	dmsaok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ccbjvy.exe"	izyyso.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\zocoks.exe"	txlkdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\qwuawb.exe"	nifoqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\aocbvm.exe"	uxlywe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ttaaen.exe"	ulzzuq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\DiskMan32.exe"	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\yxgyxu.exe"	gtikpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\dopcvc.exe"	yxgyxu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\jfgfck.exe"	dopcvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\tzquor.exe"	otaynu.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DiskMan32.dll	zocoks.exe
File created	C:\Windows\SysWOW64\irwdrr.dll	oswfjs.exe
File created	C:\Windows\SysWOW64\apxlfr.dll	ubrubo.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	oeupgw.exe
File created	C:\Windows\SysWOW64\rofvbu.dll	oeupgw.exe
File created	C:\Windows\SysWOW64\sbyufh.dll	xnzduk.exe
File created	C:\Windows\SysWOW64\ztvzfk.dll	apxlfr.exe
File created	C:\Windows\SysWOW64\xvslpt.dll	sbyufh.exe
File created	C:\Windows\SysWOW64\cmjooj.dll	xvslpt.exe
File created	C:\Windows\SysWOW64\msfkan.dll	DiskMan32.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	oednne.exe
File created	C:\Windows\SysWOW64\tssfue.dll	oenoyb.exe
File created	C:\Windows\SysWOW64\jfgfck.dll	dopcvc.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	lwhmdq.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	ulzzuq.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	buspyy.exe
File created	C:\Windows\SysWOW64\hnqvxc.dll	enqpow.exe
File created	C:\Windows\SysWOW64\fltgxi.dll	dmsaok.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	sbyufh.exe
File created	C:\Windows\SysWOW64\roukpw.dll	odjemy.exe
File created	C:\Windows\SysWOW64\yxgyxu.dll	gtikpc.exe
File created	C:\Windows\SysWOW64\hkjthb.dll	kfbkpr.exe
File created	C:\Windows\SysWOW64\twpdsg.dll	onyztz.exe
File created	C:\Windows\SysWOW64\dylrwt.dll	ttaaen.exe
File created	C:\Windows\SysWOW64\wihiea.dll	buspyy.exe
File created	C:\Windows\SysWOW64\eunfjj.dll	bvnhal.exe
File created	C:\Windows\SysWOW64\wnhyag.dll	tvesxi.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	kfbkpr.exe
File created	C:\Windows\SysWOW64\bcrhim.dll	zocoks.exe
File created	C:\Windows\SysWOW64\onrzkd.dll	wnhyag.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	hnqvxc.exe
File created	C:\Windows\SysWOW64\ccbjvy.dll	izyyso.exe
File created	C:\Windows\SysWOW64\ufjimo.dll	vxahcr.exe
File created	C:\Windows\SysWOW64\gmflrq.dll	eunfjj.exe
File created	C:\Windows\SysWOW64\odjemy.dll	msfkan.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	zxhmio.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	vxahcr.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	tvesxi.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	dopcvc.exe
File created	C:\Windows\SysWOW64\txlkdc.dll	onrzkd.exe
File created	C:\Windows\SysWOW64\lwhmdq.dll	jfgfck.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	nifoqg.exe
File created	C:\Windows\SysWOW64\enqpow.dll	zxhmio.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	ymwlsd.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	vpcxmh.exe
File created	C:\Windows\SysWOW64\ocnmqu.dll	mcuoho.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	twpdsg.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	izyyso.exe
File created	C:\Windows\SysWOW64\aumdtz.dll	ibpkje.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	axxqwd.exe
File created	C:\Windows\SysWOW64\vsejeo.dll	qcnfgz.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	vsejeo.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	aocbvm.exe
File created	C:\Windows\SysWOW64\objbvw.dll	oednne.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	jfgfck.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	ufjimo.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	bvnhal.exe
File created	C:\Windows\SysWOW64\dwrpvm.dll	gbpzta.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
File created	C:\Windows\SysWOW64\sbwerc.dll	vsejeo.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	apxlfr.exe
File created	C:\Windows\SysWOW64\sjuphm.dll	axxqwd.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	bpubrf.exe
File created	C:\Windows\SysWOW64\aakkax.dll	yxgyxu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\tvesxi.exe	oenoyb.exe
File created	C:\Windows\onrzkd.exe	wnhyag.exe
File created	C:\Windows\DiskMan32.exe	zocoks.exe
File opened for modification	C:\Windows\qcnfgz.exe	qxyclm.exe
File opened for modification	C:\Windows\vpcxmh.exe	vsejeo.exe
File created	C:\Windows\DiskMan32.exe	nifoqg.exe
File created	C:\Windows\esvutg.exe	hnqvxc.exe
File created	C:\Windows\uxlywe.exe	vpcxmh.exe
File created	C:\Windows\hnqvxc.exe	enqpow.exe
File created	C:\Windows\DiskMan32.exe	ttaaen.exe
File opened for modification	C:\Windows\izyyso.exe	dmsaok.exe
File opened for modification	C:\Windows\DiskMan32.exe	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
File opened for modification	C:\Windows\zocoks.exe	txlkdc.exe
File opened for modification	C:\Windows\nunqaj.exe	qwuawb.exe
File opened for modification	C:\Windows\aocbvm.exe	uxlywe.exe
File opened for modification	C:\Windows\oeupgw.exe	gougjf.exe
File opened for modification	C:\Windows\axxqwd.exe	ibpkje.exe
File created	C:\Windows\DiskMan32.exe	ufjimo.exe
File created	C:\Windows\rsjiey.exe	oeupgw.exe
File created	C:\Windows\DiskMan32.exe	twpdsg.exe
File created	C:\Windows\DiskMan32.exe	dmsaok.exe
File created	C:\Windows\drlfxi.exe	ccbjvy.exe
File created	C:\Windows\DiskMan32.exe	doktfb.exe
File created	C:\Windows\DiskMan32.exe	bpubrf.exe
File created	C:\Windows\DiskMan32.exe	oenoyb.exe
File created	C:\Windows\vsejeo.exe	qcnfgz.exe
File created	C:\Windows\otaynu.exe	ttaaen.exe
File created	C:\Windows\DiskMan32.exe	tzquor.exe
File created	C:\Windows\dzdkzd.exe	ymxmds.exe
File created	C:\Windows\yryjmy.exe	yvsvff.exe
File opened for modification	C:\Windows\ufjimo.exe	vxahcr.exe
File created	C:\Windows\DiskMan32.exe	bvnhal.exe
File created	C:\Windows\DiskMan32.exe	roukpw.exe
File opened for modification	C:\Windows\oenoyb.exe	oednne.exe
File created	C:\Windows\gtikpc.exe	bcrhim.exe
File created	C:\Windows\vpcxmh.exe	vsejeo.exe
File created	C:\Windows\DiskMan32.exe	aocbvm.exe
File created	C:\Windows\DiskMan32.exe	esvutg.exe
File opened for modification	C:\Windows\ibpkje.exe	doktfb.exe
File opened for modification	C:\Windows\xnzduk.exe	zsrzto.exe
File created	C:\Windows\ivzquv.exe	oswfjs.exe
File created	C:\Windows\ubrubo.exe	aocbvm.exe
File created	C:\Windows\DiskMan32.exe	zxhmio.exe
File created	C:\Windows\yvsvff.exe	dzdkzd.exe
File created	C:\Windows\DiskMan32.exe	ccbjvy.exe
File created	C:\Windows\gbpzta.exe	gmflrq.exe
File created	C:\Windows\DiskMan32.exe	jfgfck.exe
File created	C:\Windows\DiskMan32.exe	qwuawb.exe
File created	C:\Windows\DiskMan32.exe	oeupgw.exe
File created	C:\Windows\DiskMan32.exe	onyztz.exe
File created	C:\Windows\txlkdc.exe	onrzkd.exe
File opened for modification	C:\Windows\uxlywe.exe	vpcxmh.exe
File created	C:\Windows\apxlfr.exe	ubrubo.exe
File created	C:\Windows\twpdsg.exe	onyztz.exe
File created	C:\Windows\DiskMan32.exe	ulzzuq.exe
File opened for modification	C:\Windows\ymxmds.exe	ymwlsd.exe
File created	C:\Windows\axxqwd.exe	ibpkje.exe
File created	C:\Windows\DiskMan32.exe	cjyeha.exe
File created	C:\Windows\DiskMan32.exe	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
File created	C:\Windows\oednne.exe	roukpw.exe
File created	C:\Windows\DiskMan32.exe	txlkdc.exe
File created	C:\Windows\DiskMan32.exe	lwhmdq.exe
File created	C:\Windows\DiskMan32.exe	gougjf.exe
File opened for modification	C:\Windows\dmsaok.exe	yryjmy.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiskMan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hnqvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twpdsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulzzuq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ttaaen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axxqwd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oenoyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nunqaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvsvff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drlfxi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gmflrq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oswfjs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ivzquv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfbkpr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zsrzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oednne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oeupgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dzdkzd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sbyufh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rsjiey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	izyyso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbpzta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lwhmdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uxlywe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	enqpow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vxahcr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvslpt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnhyag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ubrubo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onyztz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ymxmds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cjyeha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wihiea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxhmio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvnhal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msfkan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfgfck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ymwlsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ibpkje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gjxiqr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esvutg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mcuoho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dmsaok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eunfjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	otaynu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ufjimo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xnzduk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bpubrf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsejeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onrzkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zocoks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcrhim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gtikpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dopcvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tzquor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tvesxi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yxgyxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpcxmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccbjvy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roukpw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txlkdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qwuawb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apxlfr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yryjmy.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4168	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4168	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4168	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4168	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4832	DiskMan32.exe
4832	DiskMan32.exe
4832	DiskMan32.exe
4832	DiskMan32.exe
3340	msfkan.exe
3340	msfkan.exe
3340	msfkan.exe
3340	msfkan.exe
1616	odjemy.exe
1616	odjemy.exe
1616	odjemy.exe
1616	odjemy.exe
2304	roukpw.exe
2304	roukpw.exe
2304	roukpw.exe
2304	roukpw.exe
884	oednne.exe
884	oednne.exe
884	oednne.exe
884	oednne.exe
1236	oenoyb.exe
1236	oenoyb.exe
1236	oenoyb.exe
1236	oenoyb.exe
4280	tvesxi.exe
4280	tvesxi.exe
4280	tvesxi.exe
4280	tvesxi.exe
4928	wnhyag.exe
4928	wnhyag.exe
4928	wnhyag.exe
4928	wnhyag.exe
220	onrzkd.exe
220	onrzkd.exe
220	onrzkd.exe
220	onrzkd.exe
1076	txlkdc.exe
1076	txlkdc.exe
1076	txlkdc.exe
1076	txlkdc.exe
3348	zocoks.exe
3348	zocoks.exe
3348	zocoks.exe
3348	zocoks.exe
3940	bcrhim.exe
3940	bcrhim.exe
3940	bcrhim.exe
3940	bcrhim.exe
2568	gtikpc.exe
2568	gtikpc.exe
2568	gtikpc.exe
2568	gtikpc.exe
4532	yxgyxu.exe
4532	yxgyxu.exe
4532	yxgyxu.exe
4532	yxgyxu.exe
4256	dopcvc.exe
4256	dopcvc.exe
4256	dopcvc.exe
4256	dopcvc.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4168	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4832	DiskMan32.exe
3340	msfkan.exe
1616	odjemy.exe
2304	roukpw.exe
884	oednne.exe
1236	oenoyb.exe
4280	tvesxi.exe
4928	wnhyag.exe
220	onrzkd.exe
1076	txlkdc.exe
3348	zocoks.exe
3940	bcrhim.exe
2568	gtikpc.exe
4532	yxgyxu.exe
4256	dopcvc.exe
2872	jfgfck.exe
5284	lwhmdq.exe
5468	oswfjs.exe
5640	ivzquv.exe
5804	nifoqg.exe
5392	qwuawb.exe
3832	nunqaj.exe
5608	qxyclm.exe
5604	qcnfgz.exe
5720	vsejeo.exe
1620	vpcxmh.exe
5732	uxlywe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3284	4168	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe	56
PID 4832 wrote to memory of 3284	4832	DiskMan32.exe	56
PID 3340 wrote to memory of 3284	3340	msfkan.exe	56
PID 1616 wrote to memory of 3284	1616	odjemy.exe	56
PID 2304 wrote to memory of 3284	2304	roukpw.exe	56
PID 884 wrote to memory of 3284	884	oednne.exe	56
PID 1236 wrote to memory of 3284	1236	oenoyb.exe	56
PID 4280 wrote to memory of 3284	4280	tvesxi.exe	56
PID 4928 wrote to memory of 3284	4928	wnhyag.exe	56
PID 220 wrote to memory of 3284	220	onrzkd.exe	56
PID 1076 wrote to memory of 3284	1076	txlkdc.exe	56
PID 3348 wrote to memory of 3284	3348	zocoks.exe	56
PID 3940 wrote to memory of 3284	3940	bcrhim.exe	56
PID 2568 wrote to memory of 3284	2568	gtikpc.exe	56
PID 4532 wrote to memory of 3284	4532	yxgyxu.exe	56
PID 4256 wrote to memory of 3284	4256	dopcvc.exe	56
PID 2872 wrote to memory of 3284	2872	jfgfck.exe	56
PID 5284 wrote to memory of 3284	5284	lwhmdq.exe	56
PID 5468 wrote to memory of 3284	5468	oswfjs.exe	56
PID 5640 wrote to memory of 3284	5640	ivzquv.exe	56
PID 5804 wrote to memory of 3284	5804	nifoqg.exe	56
PID 5392 wrote to memory of 3284	5392	qwuawb.exe	56
PID 3832 wrote to memory of 3284	3832	nunqaj.exe	56
PID 5608 wrote to memory of 3284	5608	qxyclm.exe	56
PID 5604 wrote to memory of 3284	5604	qcnfgz.exe	56
PID 5720 wrote to memory of 3284	5720	vsejeo.exe	56
PID 1620 wrote to memory of 3284	1620	vpcxmh.exe	56
PID 5732 wrote to memory of 3284	5732	uxlywe.exe	56
PID 2828 wrote to memory of 3284	2828	aocbvm.exe	56
PID 6240 wrote to memory of 3284	6240	ubrubo.exe	56
PID 6396 wrote to memory of 3284	6396	apxlfr.exe	56
PID 6616 wrote to memory of 3284	6616	zxhmio.exe	56
PID 6776 wrote to memory of 3284	6776	enqpow.exe	56
PID 6936 wrote to memory of 3284	6936	hnqvxc.exe	56
PID 7144 wrote to memory of 3284	7144	esvutg.exe	56
PID 6320 wrote to memory of 3284	6320	kfbkpr.exe	56
PID 4572 wrote to memory of 3284	4572	gougjf.exe	56
PID 4104 wrote to memory of 3284	4104	oeupgw.exe	56
PID 4440 wrote to memory of 3284	4440	rsjiey.exe	56
PID 6160 wrote to memory of 3284	6160	mcuoho.exe	56
PID 6420 wrote to memory of 3284	6420	onyztz.exe	56
PID 4124 wrote to memory of 3284	4124	twpdsg.exe	56
PID 1680 wrote to memory of 3284	1680	ulzzuq.exe	56
PID 1128 wrote to memory of 3284	1128	ttaaen.exe	56
PID 5192 wrote to memory of 3284	5192	otaynu.exe	56
PID 7184 wrote to memory of 3284	7184	tzquor.exe	56
PID 7348 wrote to memory of 3284	7348	ymwlsd.exe	56
PID 7504 wrote to memory of 3284	7504	ymxmds.exe	56
PID 7660 wrote to memory of 3284	7660	dzdkzd.exe	56
PID 7820 wrote to memory of 3284	7820	yvsvff.exe	56
PID 7984 wrote to memory of 3284	7984	yryjmy.exe	56
PID 8148 wrote to memory of 3284	8148	dmsaok.exe	56
PID 7260 wrote to memory of 3284	7260	izyyso.exe	56
PID 6428 wrote to memory of 3284	6428	ccbjvy.exe	56
PID 7788 wrote to memory of 3284	7788	drlfxi.exe	56
PID 8024 wrote to memory of 3284	8024	doktfb.exe	56
PID 752 wrote to memory of 3284	752	ibpkje.exe	56
PID 4984 wrote to memory of 3284	4984	axxqwd.exe	56
PID 5824 wrote to memory of 3284	5824	vxahcr.exe	56
PID 6712 wrote to memory of 3284	6712	ufjimo.exe	56
PID 1136 wrote to memory of 3284	1136	cjyeha.exe	56
PID 4728 wrote to memory of 3284	4728	zsrzto.exe	56
PID 1316 wrote to memory of 3284	1316	xnzduk.exe	56
PID 4904 wrote to memory of 3284	4904	sbyufh.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3284
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4168

C:\Windows\DiskMan32.exe
C:\Windows\DiskMan32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\msfkan.exe
C:\Windows\msfkan.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340

C:\Windows\odjemy.exe
C:\Windows\odjemy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\roukpw.exe
C:\Windows\roukpw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\oednne.exe
C:\Windows\oednne.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\oenoyb.exe
C:\Windows\oenoyb.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\tvesxi.exe
C:\Windows\tvesxi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280

C:\Windows\wnhyag.exe
C:\Windows\wnhyag.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\onrzkd.exe
C:\Windows\onrzkd.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\txlkdc.exe
C:\Windows\txlkdc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\zocoks.exe
C:\Windows\zocoks.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\bcrhim.exe
C:\Windows\bcrhim.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\gtikpc.exe
C:\Windows\gtikpc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\yxgyxu.exe
C:\Windows\yxgyxu.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\dopcvc.exe
C:\Windows\dopcvc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\jfgfck.exe
C:\Windows\jfgfck.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\lwhmdq.exe
C:\Windows\lwhmdq.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284

C:\Windows\oswfjs.exe
C:\Windows\oswfjs.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468

C:\Windows\ivzquv.exe
C:\Windows\ivzquv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640

C:\Windows\nifoqg.exe
C:\Windows\nifoqg.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804

C:\Windows\qwuawb.exe
C:\Windows\qwuawb.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392

C:\Windows\nunqaj.exe
C:\Windows\nunqaj.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\qxyclm.exe
C:\Windows\qxyclm.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608

C:\Windows\qcnfgz.exe
C:\Windows\qcnfgz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604

C:\Windows\vsejeo.exe
C:\Windows\vsejeo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720

C:\Windows\vpcxmh.exe
C:\Windows\vpcxmh.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\uxlywe.exe
C:\Windows\uxlywe.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732

C:\Windows\aocbvm.exe
C:\Windows\aocbvm.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\ubrubo.exe
C:\Windows\ubrubo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6240

C:\Windows\apxlfr.exe
C:\Windows\apxlfr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6396

C:\Windows\zxhmio.exe
C:\Windows\zxhmio.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6616

C:\Windows\enqpow.exe
C:\Windows\enqpow.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6776

C:\Windows\hnqvxc.exe
C:\Windows\hnqvxc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6936

C:\Windows\esvutg.exe
C:\Windows\esvutg.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7144

C:\Windows\kfbkpr.exe
C:\Windows\kfbkpr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6320

C:\Windows\gougjf.exe
C:\Windows\gougjf.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\oeupgw.exe
C:\Windows\oeupgw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\rsjiey.exe
C:\Windows\rsjiey.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\mcuoho.exe
C:\Windows\mcuoho.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6160

C:\Windows\onyztz.exe
C:\Windows\onyztz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6420

C:\Windows\twpdsg.exe
C:\Windows\twpdsg.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\ulzzuq.exe
C:\Windows\ulzzuq.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\ttaaen.exe
C:\Windows\ttaaen.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\otaynu.exe
C:\Windows\otaynu.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5192

C:\Windows\tzquor.exe
C:\Windows\tzquor.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7184

C:\Windows\ymwlsd.exe
C:\Windows\ymwlsd.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7348

C:\Windows\ymxmds.exe
C:\Windows\ymxmds.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7504

C:\Windows\dzdkzd.exe
C:\Windows\dzdkzd.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7660

C:\Windows\yvsvff.exe
C:\Windows\yvsvff.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7820

C:\Windows\yryjmy.exe
C:\Windows\yryjmy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7984

C:\Windows\dmsaok.exe
C:\Windows\dmsaok.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8148

C:\Windows\izyyso.exe
C:\Windows\izyyso.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7260

C:\Windows\ccbjvy.exe
C:\Windows\ccbjvy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6428

C:\Windows\drlfxi.exe
C:\Windows\drlfxi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7788

C:\Windows\doktfb.exe
C:\Windows\doktfb.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:8024

C:\Windows\ibpkje.exe
C:\Windows\ibpkje.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\axxqwd.exe
C:\Windows\axxqwd.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\vxahcr.exe
C:\Windows\vxahcr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5824

C:\Windows\ufjimo.exe
C:\Windows\ufjimo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6712

C:\Windows\cjyeha.exe
C:\Windows\cjyeha.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\zsrzto.exe
C:\Windows\zsrzto.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\xnzduk.exe
C:\Windows\xnzduk.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\sbyufh.exe
C:\Windows\sbyufh.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\xvslpt.exe
C:\Windows\xvslpt.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5932

C:\Windows\bpubrf.exe
C:\Windows\bpubrf.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6388

C:\Windows\buspyy.exe
C:\Windows\buspyy.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4172

C:\Windows\wihiea.exe
C:\Windows\wihiea.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:7292

C:\Windows\bvnhal.exe
C:\Windows\bvnhal.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2232

C:\Windows\eunfjj.exe
C:\Windows\eunfjj.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:928

C:\Windows\gmflrq.exe
C:\Windows\gmflrq.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:636

C:\Windows\gbpzta.exe
C:\Windows\gbpzta.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4972

C:\Windows\gjxiqr.exe
C:\Windows\gjxiqr.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DiskMan32.exe

Path C:\Windows\DiskMan32.exe
Size 29KB
SHA256 cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04
MD5 9ec06c20cc9c39ef5e04011da0622e6b
SHA1 a375405845e66292eb511eee3e29beb8ace56450
SHA512 2f7bd960bf7d79c8feef3f111ec47417d1e6c83ec215718db9dde4aaff39cffd7c54d5c8cc63e903737c7fbaffb3cd6a20f35c2fe98c764948d0a1e6e3eb532f
SSDEEP 768:b0NbTbHCVklgq4UtHKBqOEdkL2FikxbJe+QP:bsz+klz4ksXP
TLSH
T192D22B47675444F2D2EB4674B6520F3B9FBE88743B91E4A7C7335BC29CA42D2A534207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiskMan32.dll

Path C:\Windows\SysWOW64\DiskMan32.dll
Size 21KB
SHA256 aee70082c8fed657361bf3f17de077efd5e5025fd2cc2694606427d436219ee0
MD5 4aae4c7a5900bf12610006e7ea9497e3
SHA1 b26be68407755d4b252df62f8242756f5d94a0f2
SHA512 90aa1c139174b3a033ff36fd7f31bb2b7cbaf5590a69695b342a0b958180637964fccaa385a5a60496b97834aff251fa6ac991de72b15f610c9b59125137d654
SSDEEP 384:Dx6CV1zKlgqvs9Ut5AfwKBqOEJ4fokLlfMjKt2FikaybJqf+xSP:YCVklgq4UtHKBqOEdkL2FikxbJe+QP
TLSH
T13EA22A46975888F2E3FB4234B2920F375A7E887439D1B557CB334BD19DA41D6EA3420B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-157-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/884-105-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1076-171-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1236-118-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1616-80-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1620-386-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2304-92-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2568-213-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2828-414-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2872-257-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3284-408-0x000000000C960000-0x000000000C961000-memory.dmp

Download

memory/3284-326-0x000000000B720000-0x000000000B721000-memory.dmp

Download

memory/3284-109-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/3284-62-0x0000000008F30000-0x0000000008F31000-memory.dmp

Download

memory/3284-122-0x00000000099B0000-0x00000000099B1000-memory.dmp

Download

memory/3284-422-0x0000000009DA0000-0x0000000009DA1000-memory.dmp

Download

memory/3284-135-0x0000000009A60000-0x0000000009A61000-memory.dmp

Download

memory/3284-97-0x0000000008DE0000-0x0000000008DE1000-memory.dmp

Download

memory/3284-148-0x0000000009B10000-0x0000000009B11000-memory.dmp

Download

memory/3284-60-0x0000000008E00000-0x0000000008E01000-memory.dmp

Download

memory/3284-218-0x00000000036D0000-0x00000000036D1000-memory.dmp

Download

memory/3284-437-0x000000000CAD0000-0x000000000CAD1000-memory.dmp

Download

memory/3284-176-0x0000000003430000-0x0000000003431000-memory.dmp

Download

memory/3284-2-0x0000000003330000-0x0000000003331000-memory.dmp

Download

memory/3284-190-0x0000000003420000-0x0000000003421000-memory.dmp

Download

memory/3284-72-0x0000000008F60000-0x0000000008F61000-memory.dmp

Download

memory/3284-313-0x000000000B3E0000-0x000000000B3E1000-memory.dmp

Download

memory/3284-203-0x0000000003480000-0x0000000003481000-memory.dmp

Download

memory/3284-162-0x0000000009D50000-0x0000000009D51000-memory.dmp

Download

memory/3284-394-0x000000000C060000-0x000000000C061000-memory.dmp

Download

memory/3284-232-0x0000000003700000-0x0000000003701000-memory.dmp

Download

memory/3284-452-0x000000000CB80000-0x000000000CB81000-memory.dmp

Download

memory/3284-247-0x0000000003730000-0x0000000003731000-memory.dmp

Download

memory/3284-84-0x0000000008F90000-0x0000000008F91000-memory.dmp

Download

memory/3284-263-0x0000000009210000-0x0000000009211000-memory.dmp

Download

memory/3284-380-0x000000000C020000-0x000000000C021000-memory.dmp

Download

memory/3284-275-0x0000000009DD0000-0x0000000009DD1000-memory.dmp

Download

memory/3284-366-0x000000000BFF0000-0x000000000BFF1000-memory.dmp

Download

memory/3284-287-0x000000000B390000-0x000000000B391000-memory.dmp

Download

memory/3284-352-0x000000000BC30000-0x000000000BC31000-memory.dmp

Download

memory/3284-300-0x0000000009200000-0x0000000009201000-memory.dmp

Download

memory/3284-339-0x000000000BB80000-0x000000000BB81000-memory.dmp

Download

memory/3340-68-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3348-185-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3832-332-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3940-199-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4168-46-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4256-242-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4280-131-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4532-227-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4832-56-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4928-144-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5284-269-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5392-319-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5468-281-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5604-358-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5608-345-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5640-293-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5720-372-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5732-400-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5804-306-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6240-428-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6396-443-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6616-458-0x0000000010000000-0x0000000010009000-memory.dmp

Download