3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

Analysis

max time kernel
152s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a.exe
Size

96KB
MD5

16df5cdb0dd3701f287c5f810bd5b1cd
SHA1

6f638d0ec31edc6912fb4f5eeeaa37403a782e42
SHA256

3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a
SHA512

807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\DirectX.exe"	ABCHELP.EXE

ASPack v2.12-2.42 34 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\DirectX.exe	aspack_v212_v242
C:\Windows\SysWOW64\WINhelp32.exe	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242
C:\Windows\SysWOW64\ABCHELP.EXE	aspack_v212_v242

Executes dropped EXE 64 IoCs

Processes:

pid	process
2312	ABCHELP.EXE
4808	ABCHELP.EXE
1944	ABCHELP.EXE
1808	ABCHELP.EXE
652	ABCHELP.EXE
916	ABCHELP.EXE
4724	ABCHELP.EXE
2336	ABCHELP.EXE
2776	ABCHELP.EXE
2076	ABCHELP.EXE
1192	ABCHELP.EXE
2384	ABCHELP.EXE
4700	ABCHELP.EXE
4632	ABCHELP.EXE
4684	ABCHELP.EXE
2196	ABCHELP.EXE
3256	ABCHELP.EXE
1904	ABCHELP.EXE
2412	ABCHELP.EXE
3076	ABCHELP.EXE
3684	ABCHELP.EXE
1720	ABCHELP.EXE
4524	ABCHELP.EXE
3160	ABCHELP.EXE
3404	ABCHELP.EXE
1272	ABCHELP.EXE
3928	ABCHELP.EXE
868	ABCHELP.EXE
4492	ABCHELP.EXE
4368	ABCHELP.EXE
620	ABCHELP.EXE
2184	ABCHELP.EXE
3780	ABCHELP.EXE
4756	ABCHELP.EXE
5052	ABCHELP.EXE
3264	ABCHELP.EXE
2960	ABCHELP.EXE
3152	ABCHELP.EXE
508	ABCHELP.EXE
4224	ABCHELP.EXE
1836	ABCHELP.EXE
4776	ABCHELP.EXE
2308	ABCHELP.EXE
924	ABCHELP.EXE
1968	ABCHELP.EXE
4288	ABCHELP.EXE
1380	ABCHELP.EXE
4276	ABCHELP.EXE
2092	ABCHELP.EXE
5100	ABCHELP.EXE
2164	ABCHELP.EXE
3164	ABCHELP.EXE
2292	ABCHELP.EXE
768	ABCHELP.EXE
3816	ABCHELP.EXE
4468	ABCHELP.EXE
2012	ABCHELP.EXE
2028	ABCHELP.EXE
3632	ABCHELP.EXE
2648	ABCHELP.EXE
3856	ABCHELP.EXE
2320	ABCHELP.EXE
772	ABCHELP.EXE
3516	ABCHELP.EXE

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "abchelp.exe"	ABCHELP.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	ABCHELP.EXE

Drops file in System32 directory 64 IoCs

Processes:

system.exeABCHELP.EXEABCHELP.EXEABCHELP.EXEsystem.exeABCHELP.EXEsystem.exeABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEsystem.exeABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEsystem.exesystem.exesystem.exesystem.exeABCHELP.EXEABCHELP.EXEsystem.exesystem.exeABCHELP.EXEsystem.exesystem.exeABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEsystem.exeABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEsystem.exeABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXE

description	ioc	process
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\system.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\system.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\system.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File created	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\system.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\system.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\system.exe	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File opened for modification	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	system.exe
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File created	C:\Windows\SysWOW64\WINhelp32.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\DirectX.exe	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE
File created	C:\Windows\SysWOW64\ABCHELP.EXE	ABCHELP.EXE

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
10524	10340	WerFault.exe	ABCHELP.EXE
11884	10340	WerFault.exe	ABCHELP.EXE
16236	5140	WerFault.exe	system.exe
11532	7604	WerFault.exe
3196	13804	WerFault.exe	system.exe
620	13024	WerFault.exe	system.exe
5808	13804	WerFault.exe	system.exe
16232	7604	WerFault.exe
4520	5140	WerFault.exe	system.exe

Modifies registry class 64 IoCs

Processes:

system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZPwd_box\CreakCount = "1"	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	system.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

system.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exeIEXPLORE .EXEsystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exesystem.exe

pid	process
4696	system.exe
10976	system.exe
10924	system.exe
5112	system.exe
10388	system.exe
10540	system.exe
4712	system.exe
11068	system.exe
11016	system.exe
4696	system.exe
11084	system.exe
11136	system.exe
3100	system.exe
2056	system.exe
380	system.exe
11284	system.exe
11276	IEXPLORE .EXE
11308	system.exe
11324	system.exe
11344	system.exe
11360	system.exe
11376	system.exe
11392	system.exe
11408	system.exe
11424	system.exe
11440	system.exe
11456	system.exe
11464	system.exe
11488	system.exe
11504	system.exe
11524	system.exe
11540	system.exe
11556	system.exe
11572	system.exe
11592	system.exe
11608	system.exe
11628	system.exe
11644	system.exe
11660	system.exe
11680	system.exe
11696	system.exe
11712	system.exe
11728	system.exe
11748	system.exe
11764	system.exe
11780	system.exe
11800	system.exe
11816	system.exe
11832	system.exe
11864	system.exe
11892	system.exe
11916	system.exe
11936	system.exe
11952	system.exe
11968	system.exe
11984	system.exe
12004	system.exe
12036	system.exe
12056	system.exe
12068	system.exe
12028	system.exe
12092	system.exe
12104	system.exe
12140	system.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a.exeABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXEABCHELP.EXE

description	pid	process	target process
PID 1392 wrote to memory of 2312	1392	3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a.exe	ABCHELP.EXE
PID 1392 wrote to memory of 2312	1392	3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a.exe	ABCHELP.EXE
PID 1392 wrote to memory of 2312	1392	3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a.exe	ABCHELP.EXE
PID 2312 wrote to memory of 4808	2312	ABCHELP.EXE	ABCHELP.EXE
PID 2312 wrote to memory of 4808	2312	ABCHELP.EXE	ABCHELP.EXE
PID 2312 wrote to memory of 4808	2312	ABCHELP.EXE	ABCHELP.EXE
PID 4808 wrote to memory of 1944	4808	ABCHELP.EXE	ABCHELP.EXE
PID 4808 wrote to memory of 1944	4808	ABCHELP.EXE	ABCHELP.EXE
PID 4808 wrote to memory of 1944	4808	ABCHELP.EXE	ABCHELP.EXE
PID 1944 wrote to memory of 1808	1944	ABCHELP.EXE	ABCHELP.EXE
PID 1944 wrote to memory of 1808	1944	ABCHELP.EXE	ABCHELP.EXE
PID 1944 wrote to memory of 1808	1944	ABCHELP.EXE	ABCHELP.EXE
PID 1808 wrote to memory of 652	1808	ABCHELP.EXE	ABCHELP.EXE
PID 1808 wrote to memory of 652	1808	ABCHELP.EXE	ABCHELP.EXE
PID 1808 wrote to memory of 652	1808	ABCHELP.EXE	ABCHELP.EXE
PID 652 wrote to memory of 916	652	ABCHELP.EXE	ABCHELP.EXE
PID 652 wrote to memory of 916	652	ABCHELP.EXE	ABCHELP.EXE
PID 652 wrote to memory of 916	652	ABCHELP.EXE	ABCHELP.EXE
PID 916 wrote to memory of 4724	916	ABCHELP.EXE	ABCHELP.EXE
PID 916 wrote to memory of 4724	916	ABCHELP.EXE	ABCHELP.EXE
PID 916 wrote to memory of 4724	916	ABCHELP.EXE	ABCHELP.EXE
PID 4724 wrote to memory of 2336	4724	ABCHELP.EXE	ABCHELP.EXE
PID 4724 wrote to memory of 2336	4724	ABCHELP.EXE	ABCHELP.EXE
PID 4724 wrote to memory of 2336	4724	ABCHELP.EXE	ABCHELP.EXE
PID 2336 wrote to memory of 2776	2336	ABCHELP.EXE	ABCHELP.EXE
PID 2336 wrote to memory of 2776	2336	ABCHELP.EXE	ABCHELP.EXE
PID 2336 wrote to memory of 2776	2336	ABCHELP.EXE	ABCHELP.EXE
PID 2776 wrote to memory of 2076	2776	ABCHELP.EXE	ABCHELP.EXE
PID 2776 wrote to memory of 2076	2776	ABCHELP.EXE	ABCHELP.EXE
PID 2776 wrote to memory of 2076	2776	ABCHELP.EXE	ABCHELP.EXE
PID 2076 wrote to memory of 1192	2076	ABCHELP.EXE	ABCHELP.EXE
PID 2076 wrote to memory of 1192	2076	ABCHELP.EXE	ABCHELP.EXE
PID 2076 wrote to memory of 1192	2076	ABCHELP.EXE	ABCHELP.EXE
PID 1192 wrote to memory of 2384	1192	ABCHELP.EXE	ABCHELP.EXE
PID 1192 wrote to memory of 2384	1192	ABCHELP.EXE	ABCHELP.EXE
PID 1192 wrote to memory of 2384	1192	ABCHELP.EXE	ABCHELP.EXE
PID 2384 wrote to memory of 4700	2384	ABCHELP.EXE	ABCHELP.EXE
PID 2384 wrote to memory of 4700	2384	ABCHELP.EXE	ABCHELP.EXE
PID 2384 wrote to memory of 4700	2384	ABCHELP.EXE	ABCHELP.EXE
PID 4700 wrote to memory of 4632	4700	ABCHELP.EXE	ABCHELP.EXE
PID 4700 wrote to memory of 4632	4700	ABCHELP.EXE	ABCHELP.EXE
PID 4700 wrote to memory of 4632	4700	ABCHELP.EXE	ABCHELP.EXE
PID 4632 wrote to memory of 4684	4632	ABCHELP.EXE	ABCHELP.EXE
PID 4632 wrote to memory of 4684	4632	ABCHELP.EXE	ABCHELP.EXE
PID 4632 wrote to memory of 4684	4632	ABCHELP.EXE	ABCHELP.EXE
PID 4684 wrote to memory of 2196	4684	ABCHELP.EXE	ABCHELP.EXE
PID 4684 wrote to memory of 2196	4684	ABCHELP.EXE	ABCHELP.EXE
PID 4684 wrote to memory of 2196	4684	ABCHELP.EXE	ABCHELP.EXE
PID 2196 wrote to memory of 3256	2196	ABCHELP.EXE	ABCHELP.EXE
PID 2196 wrote to memory of 3256	2196	ABCHELP.EXE	ABCHELP.EXE
PID 2196 wrote to memory of 3256	2196	ABCHELP.EXE	ABCHELP.EXE
PID 3256 wrote to memory of 1904	3256	ABCHELP.EXE	ABCHELP.EXE
PID 3256 wrote to memory of 1904	3256	ABCHELP.EXE	ABCHELP.EXE
PID 3256 wrote to memory of 1904	3256	ABCHELP.EXE	ABCHELP.EXE
PID 1904 wrote to memory of 2412	1904	ABCHELP.EXE	ABCHELP.EXE
PID 1904 wrote to memory of 2412	1904	ABCHELP.EXE	ABCHELP.EXE
PID 1904 wrote to memory of 2412	1904	ABCHELP.EXE	ABCHELP.EXE
PID 2412 wrote to memory of 3076	2412	ABCHELP.EXE	ABCHELP.EXE
PID 2412 wrote to memory of 3076	2412	ABCHELP.EXE	ABCHELP.EXE
PID 2412 wrote to memory of 3076	2412	ABCHELP.EXE	ABCHELP.EXE
PID 3076 wrote to memory of 3684	3076	ABCHELP.EXE	ABCHELP.EXE
PID 3076 wrote to memory of 3684	3076	ABCHELP.EXE	ABCHELP.EXE
PID 3076 wrote to memory of 3684	3076	ABCHELP.EXE	ABCHELP.EXE
PID 3684 wrote to memory of 1720	3684	ABCHELP.EXE	ABCHELP.EXE

C:\Users\Admin\AppData\Local\Temp\3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a.exe
"C:\Users\Admin\AppData\Local\Temp\3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
11⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
14⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4700

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
22⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
23⤵
- Executes dropped EXE
PID:1720

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4524

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
25⤵
- Executes dropped EXE
PID:3160

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
26⤵
- Executes dropped EXE
PID:3404

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
27⤵
- Executes dropped EXE
PID:1272

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
28⤵
- Executes dropped EXE
PID:3928

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
29⤵
- Executes dropped EXE
PID:868

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4492

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
31⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:4368

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:620

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
33⤵
- Executes dropped EXE
PID:2184

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
34⤵
- Executes dropped EXE
PID:3780

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
35⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4756

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
36⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:5052

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
37⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:3264

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2960

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
39⤵
- Executes dropped EXE
PID:3152

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
40⤵
- Executes dropped EXE
PID:508

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
41⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:4224

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1836

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
43⤵
- Executes dropped EXE
PID:4776

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
44⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:2308

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
45⤵
- Executes dropped EXE
- Adds Run key to start application
PID:924

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
46⤵
- Executes dropped EXE
PID:1968

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
47⤵
- Executes dropped EXE
PID:4288

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
48⤵
- Executes dropped EXE
PID:1380

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
49⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:4276

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
50⤵
- Executes dropped EXE
PID:2092

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
51⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:5100

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
52⤵
- Executes dropped EXE
PID:2164

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
53⤵
- Executes dropped EXE
PID:3164

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
54⤵
- Executes dropped EXE
PID:2292

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
55⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:768

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
56⤵
- Executes dropped EXE
PID:3816

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
57⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4468

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
58⤵
- Executes dropped EXE
PID:2012

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
59⤵
- Executes dropped EXE
PID:2028

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
60⤵
- Executes dropped EXE
PID:3632

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
61⤵
- Executes dropped EXE
PID:2648

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
62⤵
- Executes dropped EXE
PID:3856

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
63⤵
- Executes dropped EXE
PID:2320

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
64⤵
- Executes dropped EXE
PID:772

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
65⤵
- Executes dropped EXE
PID:3516

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
66⤵
PID:3336

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
67⤵
PID:3716

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
68⤵
PID:3532

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
69⤵
PID:4108

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
70⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3604

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
71⤵
PID:3708

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
72⤵
PID:1384

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
73⤵
PID:8

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
74⤵
PID:2732

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
75⤵
- Modifies WinLogon for persistence
PID:4260

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
76⤵
PID:1632

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
77⤵
PID:4076

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
78⤵
PID:3132

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
79⤵
PID:4128

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
80⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
PID:2268

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
81⤵
- Adds Run key to start application
PID:4860

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
82⤵
PID:2704

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
83⤵
PID:4752

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
84⤵
- Adds Run key to start application
PID:1284

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
85⤵
PID:1744

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
86⤵
PID:480

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
87⤵
PID:1500

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
88⤵
PID:3016

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
89⤵
- Drops file in System32 directory
PID:4244

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
90⤵
PID:4720

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
91⤵
- Adds Run key to start application
PID:1940

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
92⤵
PID:4584

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
93⤵
PID:4692

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
94⤵
PID:1908

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
95⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2876

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
96⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3752

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
97⤵
PID:340

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
98⤵
PID:1216

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
99⤵
PID:4360

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
100⤵
PID:312

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
101⤵
PID:1152

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
102⤵
PID:3756

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
103⤵
PID:1828

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
104⤵
- Adds Run key to start application
PID:4320

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
105⤵
- Drops file in System32 directory
PID:4680

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
106⤵
PID:4916

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
107⤵
PID:4884

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
108⤵
PID:2980

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
109⤵
PID:2208

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
110⤵
PID:5116

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
111⤵
PID:2496

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
112⤵
PID:2368

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
113⤵
PID:1652

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
114⤵
- Drops file in System32 directory
PID:1356

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
115⤵
PID:1896

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
116⤵
PID:2416

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
117⤵
PID:4256

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
118⤵
PID:852

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
119⤵
PID:2280

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
120⤵
PID:4248

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
121⤵
- Modifies WinLogon for persistence
PID:2992

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
122⤵
- Adds Run key to start application
PID:1912

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
123⤵
PID:32

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
124⤵
PID:2484

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
125⤵
- Modifies WinLogon for persistence
PID:3380

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
126⤵
PID:4652

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
127⤵
PID:1528

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
128⤵
- Adds Run key to start application
PID:4324

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
129⤵
- Drops file in System32 directory
PID:1596

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
130⤵
- Adds Run key to start application
PID:5132

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
131⤵
PID:5148

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
132⤵
PID:5164

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
133⤵
- Modifies WinLogon for persistence
PID:5180

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
134⤵
PID:5200

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
135⤵
PID:5216

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
136⤵
PID:5232

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
137⤵
- Modifies WinLogon for persistence
PID:5248

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
138⤵
- Modifies WinLogon for persistence
PID:5264

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
139⤵
PID:5280

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
140⤵
PID:5300

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
141⤵
PID:5316

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
142⤵
PID:5344

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
143⤵
PID:5380

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
144⤵
PID:5412

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
145⤵
PID:5448

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
146⤵
- Adds Run key to start application
PID:5476

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
147⤵
- Adds Run key to start application
PID:5512

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
148⤵
PID:5532

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
149⤵
- Drops file in System32 directory
PID:5548

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
150⤵
PID:5564

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
151⤵
- Modifies WinLogon for persistence
PID:5600

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
152⤵
- Adds Run key to start application
PID:5636

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
153⤵
- Adds Run key to start application
PID:5656

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
154⤵
PID:5672

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
155⤵
PID:5688

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
156⤵
PID:5704

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
157⤵
PID:5720

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
158⤵
PID:5736

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
159⤵
PID:5752

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
160⤵
PID:5768

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
161⤵
PID:5784

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
162⤵
PID:5800

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
163⤵
- Modifies WinLogon for persistence
PID:5816

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
164⤵
- Modifies WinLogon for persistence
PID:5832

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
165⤵
- Adds Run key to start application
PID:5848

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
166⤵
PID:5864

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
167⤵
- Modifies WinLogon for persistence
PID:5884

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
168⤵
PID:5908

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
169⤵
- Adds Run key to start application
PID:5932

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
170⤵
PID:5960

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
171⤵
- Modifies WinLogon for persistence
PID:5988

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
172⤵
PID:6020

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
173⤵
PID:6048

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
174⤵
PID:6076

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
175⤵
- Drops file in System32 directory
PID:6104

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
176⤵
PID:6136

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
177⤵
PID:5360

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
178⤵
PID:5388

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
179⤵
- Adds Run key to start application
PID:5420

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
180⤵
PID:5444

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
181⤵
PID:5500

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
182⤵
PID:5892

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
183⤵
- Modifies WinLogon for persistence
PID:5940

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
184⤵
- Adds Run key to start application
PID:5980

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
185⤵
- Modifies WinLogon for persistence
PID:6016

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
186⤵
PID:6044

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
187⤵
- Drops file in System32 directory
PID:6072

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
188⤵
PID:6124

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
189⤵
PID:6160

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
190⤵
PID:6176

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
191⤵
- Adds Run key to start application
PID:6204

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
192⤵
PID:6220

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
193⤵
PID:6244

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
194⤵
PID:6284

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
195⤵
- Drops file in System32 directory
PID:6328

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
196⤵
- Adds Run key to start application
PID:6360

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
197⤵
- Adds Run key to start application
PID:6388

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
198⤵
PID:6416

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
199⤵
- Modifies WinLogon for persistence
PID:6448

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
200⤵
PID:6472

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
201⤵
PID:6500

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
202⤵
PID:6520

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
203⤵
PID:6568

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
204⤵
PID:6608

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
205⤵
- Modifies WinLogon for persistence
PID:6636

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
206⤵
PID:6652

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
207⤵
PID:6672

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
208⤵
PID:6692

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
209⤵
PID:6708

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
210⤵
PID:6724

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
211⤵
- Modifies WinLogon for persistence
PID:6740

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
212⤵
PID:6756

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
213⤵
- Drops file in System32 directory
PID:6772

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
214⤵
PID:6792

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
215⤵
PID:6812

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
216⤵
PID:6840

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
217⤵
- Drops file in System32 directory
PID:6856

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
218⤵
- Adds Run key to start application
PID:6872

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
219⤵
PID:6892

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
220⤵
PID:6916

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
221⤵
PID:6940

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
222⤵
PID:6968

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
223⤵
- Modifies WinLogon for persistence
PID:6996

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
224⤵
PID:7028

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
225⤵
PID:7060

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
226⤵
PID:7096

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
227⤵
PID:7124

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
228⤵
PID:7140

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
229⤵
PID:7156

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
230⤵
PID:6264

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
231⤵
PID:6324

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
232⤵
PID:6356

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
233⤵
PID:6396

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
234⤵
PID:6440

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
235⤵
PID:6480

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
236⤵
- Drops file in System32 directory
PID:6900

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
237⤵
PID:6948

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
238⤵
PID:7004

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
239⤵
PID:7036

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
240⤵
- Modifies WinLogon for persistence
PID:7068

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
241⤵
PID:7092

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
242⤵
- Drops file in System32 directory
PID:2324

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
243⤵
PID:7180

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
244⤵
PID:7196

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
245⤵
PID:7228

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
246⤵
- Drops file in System32 directory
PID:7248

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
247⤵
PID:7264

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
248⤵
- Adds Run key to start application
PID:7296

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
249⤵
PID:7312

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
250⤵
PID:7340

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
251⤵
PID:7372

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
252⤵
PID:7396

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
253⤵
PID:7424

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
254⤵
- Modifies WinLogon for persistence
PID:7452

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
255⤵
- Modifies WinLogon for persistence
PID:7484

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
256⤵
PID:7520

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
257⤵
PID:7552

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
258⤵
- Drops file in System32 directory
PID:7576

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
259⤵
- Modifies WinLogon for persistence
PID:7592

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
260⤵
PID:7608

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
261⤵
PID:7624

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
262⤵
- Modifies WinLogon for persistence
PID:7640

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
263⤵
PID:7656

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
264⤵
- Adds Run key to start application
PID:7672

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
265⤵
- Drops file in System32 directory
PID:7688

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
266⤵
- Drops file in System32 directory
PID:7704

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
267⤵
PID:7720

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
268⤵
PID:7736

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
269⤵
PID:7752

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
270⤵
PID:7768

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
271⤵
PID:7784

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
272⤵
PID:7800

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
273⤵
PID:7820

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
274⤵
PID:7848

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
275⤵
- Adds Run key to start application
PID:7876

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
276⤵
- Drops file in System32 directory
PID:7912

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
277⤵
PID:7940

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
278⤵
PID:7972

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
279⤵
PID:8000

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
280⤵
- Adds Run key to start application
PID:8028

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
281⤵
PID:8052

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
282⤵
- Modifies WinLogon for persistence
PID:8076

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
283⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:8092

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
284⤵
- Adds Run key to start application
PID:8116

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
285⤵
PID:8132

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
286⤵
PID:8148

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
287⤵
- Modifies WinLogon for persistence
PID:8168

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
288⤵
PID:8184

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
289⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:7328

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
290⤵
PID:7364

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
291⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:7392

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
292⤵
PID:7440

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
293⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
PID:7476

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
294⤵
PID:7508

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
295⤵
PID:7540

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
296⤵
PID:7828

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
297⤵
PID:7892

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
298⤵
PID:7932

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
299⤵
PID:4868

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
300⤵
PID:7992

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
301⤵
- Adds Run key to start application
PID:8100

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
302⤵
PID:8044

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
303⤵
- Modifies WinLogon for persistence
PID:8216

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
304⤵
PID:8272

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
305⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:8316

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
306⤵
- Drops file in System32 directory
PID:8360

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
307⤵
PID:8396

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
308⤵
PID:8416

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
309⤵
PID:8432

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
310⤵
PID:8448

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
311⤵
- Adds Run key to start application
PID:8472

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
312⤵
PID:8496

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
313⤵
PID:8512

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
314⤵
- Modifies WinLogon for persistence
PID:8528

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
315⤵
- Modifies WinLogon for persistence
PID:8544

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
316⤵
- Adds Run key to start application
PID:8560

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
317⤵
- Adds Run key to start application
PID:8576

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
318⤵
- Adds Run key to start application
PID:8592

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
319⤵
PID:8608

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
320⤵
PID:8624

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
321⤵
PID:8640

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
322⤵
- Modifies WinLogon for persistence
PID:8656

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
323⤵
- Adds Run key to start application
PID:8672

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
324⤵
- Drops file in System32 directory
PID:8692

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
325⤵
PID:8712

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
326⤵
- Adds Run key to start application
PID:8736

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
327⤵
- Modifies WinLogon for persistence
PID:8768

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
328⤵
PID:8796

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
329⤵
PID:8832

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
330⤵
PID:8856

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
331⤵
PID:8892

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
332⤵
PID:8916

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
333⤵
PID:8932

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
334⤵
PID:8948

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
335⤵
PID:8964

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
336⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
PID:8980

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
337⤵
PID:8996

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
338⤵
PID:9012

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
339⤵
PID:9028

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
340⤵
PID:9064

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
341⤵
- Adds Run key to start application
PID:9080

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
342⤵
- Modifies WinLogon for persistence
PID:9096

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
343⤵
PID:9112

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
344⤵
PID:9128

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
345⤵
PID:9144

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
346⤵
PID:9160

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
347⤵
- Modifies WinLogon for persistence
PID:9176

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
348⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:9192

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
349⤵
PID:9212

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
350⤵
PID:8268

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
351⤵
PID:8324

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
352⤵
- Modifies WinLogon for persistence
PID:8684

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
353⤵
PID:8776

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
354⤵
- Modifies WinLogon for persistence
PID:8828

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
355⤵
PID:9204

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
356⤵
- Modifies WinLogon for persistence
PID:8312

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
357⤵
PID:5496

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
358⤵
PID:8756

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
359⤵
PID:8824

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
360⤵
- Drops file in System32 directory
PID:8888

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
361⤵
- Modifies WinLogon for persistence
PID:9220

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
362⤵
PID:9236

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
363⤵
PID:9252

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
364⤵
- Modifies WinLogon for persistence
PID:9268

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
365⤵
PID:9284

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
366⤵
PID:9300

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
367⤵
PID:9316

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
368⤵
PID:9332

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
369⤵
PID:9348

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
370⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
PID:9364

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
371⤵
PID:9380

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
372⤵
- Adds Run key to start application
PID:9396

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
373⤵
PID:9416

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
374⤵
PID:9432

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
375⤵
- Drops file in System32 directory
PID:9452

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
376⤵
- Drops file in System32 directory
PID:9480

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
377⤵
PID:9508

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
378⤵
PID:9544

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
379⤵
PID:9568

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
380⤵
PID:9596

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
381⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:9632

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
382⤵
PID:9664

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
383⤵
PID:9680

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
384⤵
PID:9696

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
385⤵
- Modifies WinLogon for persistence
PID:9712

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
386⤵
- Adds Run key to start application
PID:9728

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
387⤵
- Drops file in System32 directory
PID:9744

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
388⤵
PID:9760

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
389⤵
PID:9776

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
390⤵
PID:9792

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
391⤵
PID:9808

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
392⤵
PID:9824

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
393⤵
PID:9840

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
394⤵
PID:9856

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
395⤵
- Modifies WinLogon for persistence
PID:9872

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
396⤵
PID:9888

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
397⤵
PID:9904

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
398⤵
PID:9920

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
399⤵
PID:9936

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
400⤵
PID:9952

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
401⤵
PID:9968

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
402⤵
PID:9996

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
403⤵
PID:10016

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
404⤵
- Adds Run key to start application
PID:10052

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
405⤵
PID:10084

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
406⤵
PID:10108

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
407⤵
PID:10136

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
408⤵
- Drops file in System32 directory
PID:10168

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
409⤵
- Modifies WinLogon for persistence
PID:10200

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
410⤵
PID:10228

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
411⤵
PID:5584

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
412⤵
PID:8912

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
413⤵
- Drops file in System32 directory
PID:5580

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
414⤵
- Adds Run key to start application
PID:5588

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
415⤵
PID:9472

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
416⤵
- Drops file in System32 directory
PID:4100

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
417⤵
- Modifies WinLogon for persistence
PID:9524

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
418⤵
PID:9552

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
419⤵
PID:9604

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
420⤵
PID:9624

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
421⤵
PID:9628

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
422⤵
PID:9984

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
423⤵
PID:10040

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
424⤵
- Adds Run key to start application
PID:10068

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
425⤵
PID:10092

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
426⤵
- Modifies WinLogon for persistence
PID:10132

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
427⤵
PID:10164

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
428⤵
PID:10208

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
429⤵
PID:10236

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
430⤵
PID:10252

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
431⤵
PID:10272

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
432⤵
- Drops file in System32 directory
PID:10288

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
433⤵
PID:10308

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
434⤵
PID:10344

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
435⤵
PID:10372

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
436⤵
PID:10404

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
437⤵
PID:10436

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
438⤵
- Modifies WinLogon for persistence
PID:10464

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
439⤵
PID:10492

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
440⤵
PID:10516

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
441⤵
PID:10544

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
442⤵
PID:10560

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
443⤵
PID:10576

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
444⤵
- Adds Run key to start application
PID:10592

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
445⤵
PID:10608

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
446⤵
PID:10624

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
447⤵
PID:10640

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
448⤵
PID:10656

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
449⤵
PID:10672

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
450⤵
PID:10688

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
451⤵
- Adds Run key to start application
PID:10708

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
452⤵
- Modifies WinLogon for persistence
PID:10724

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
453⤵
PID:10740

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
454⤵
PID:10756

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
455⤵
PID:10772

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
456⤵
PID:10788

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
457⤵
- Adds Run key to start application
PID:10804

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
458⤵
PID:10820

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
459⤵
PID:10836

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
460⤵
- Modifies WinLogon for persistence
PID:10852

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
461⤵
PID:10868

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
462⤵
PID:10888

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
463⤵
PID:10912

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
464⤵
- Drops file in System32 directory
PID:10940

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
465⤵
PID:10968

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
466⤵
- Adds Run key to start application
PID:10996

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
467⤵
PID:11028

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
468⤵
PID:11060

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
469⤵
- Drops file in System32 directory
PID:11092

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
470⤵
PID:11120

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
471⤵
PID:11148

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
472⤵
PID:11164

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
473⤵
PID:11180

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
474⤵
PID:11196

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
475⤵
PID:11212

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
476⤵
- Drops file in System32 directory
PID:11228

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
477⤵
PID:11244

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
478⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
PID:11260

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
479⤵
PID:10324

C:\Windows\SysWOW64\ABCHELP.EXE
C:\Windows\system32\ABCHELP.EXE
480⤵
PID:10340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10340 -s 412
481⤵
- Program crash
PID:10524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10340 -s 376
481⤵
- Program crash
PID:11884

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
480⤵
- Suspicious use of SetWindowsHookEx
PID:12036

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
479⤵
- Modifies registry class
PID:10192

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
478⤵
PID:10076

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
477⤵
PID:10124

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
476⤵
PID:10148

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
475⤵
PID:532

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
474⤵
PID:9848

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
473⤵
PID:9356

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
472⤵
PID:9388

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
471⤵
PID:9404

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
470⤵
PID:9440

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
469⤵
PID:9492

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
468⤵
- Modifies registry class
PID:9556

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
467⤵
PID:9648

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
466⤵
PID:9672

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
465⤵
PID:9340

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
464⤵
- Modifies registry class
PID:8300

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
463⤵
PID:8732

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
462⤵
PID:2360

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
461⤵
PID:8764

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
460⤵
- Modifies registry class
PID:8884

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
459⤵
PID:9228

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
458⤵
PID:9244

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
457⤵
- Modifies registry class
PID:9104

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
456⤵
PID:9140

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
455⤵
PID:9168

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
454⤵
PID:8568

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
453⤵
PID:8588

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
452⤵
- Modifies registry class
PID:8600

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
451⤵
PID:8632

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
450⤵
PID:8652

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
449⤵
PID:8680

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
448⤵
PID:3192

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
447⤵
PID:15308

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
446⤵
PID:15316

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
445⤵
PID:15324

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
444⤵
PID:15332

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
443⤵
PID:15340

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
442⤵
PID:15292

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
441⤵
PID:15204

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
440⤵
PID:15212

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
439⤵
- Modifies registry class
PID:15220

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
438⤵
PID:15164

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
437⤵
PID:15172

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
436⤵
PID:15144

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
435⤵
PID:15152

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
434⤵
PID:15100

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
433⤵
PID:15108

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
432⤵
PID:15116

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
431⤵
- Modifies registry class
PID:15060

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
430⤵
PID:15068

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
429⤵
PID:15048

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
428⤵
PID:15032

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
427⤵
- Modifies registry class
PID:15008

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
426⤵
PID:15020

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
425⤵
PID:14988

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
424⤵
PID:14968

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
423⤵
PID:14976

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
422⤵
PID:14948

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
421⤵
PID:14928

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
420⤵
PID:14936

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
419⤵
PID:14904

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
418⤵
PID:14912

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
417⤵
PID:14864

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
416⤵
PID:14872

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
415⤵
PID:14880

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
414⤵
PID:14856

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
413⤵
PID:14832

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
412⤵
PID:14812

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
411⤵
PID:14820

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
410⤵
PID:14792

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
409⤵
PID:14800

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
408⤵
PID:14752

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
407⤵
PID:14744

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
406⤵
PID:14736

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
405⤵
- Modifies registry class
PID:14708

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
404⤵
PID:14716

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
403⤵
PID:14660

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
402⤵
PID:14668

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
401⤵
PID:14648

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
400⤵
PID:14636

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
399⤵
PID:14616

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
398⤵
- Modifies registry class
PID:14624

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
397⤵
PID:14596

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
396⤵
PID:14604

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
395⤵
PID:14580

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
394⤵
PID:14540

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
393⤵
PID:14548

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
392⤵
PID:14560

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
391⤵
- Modifies registry class
PID:14528

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
390⤵
PID:14508

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
389⤵
PID:14516

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
388⤵
PID:14500

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
387⤵
PID:14460

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
386⤵
PID:14468

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
385⤵
PID:14436

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
384⤵
- Drops file in System32 directory
PID:14444

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
383⤵
PID:14412

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
382⤵
- Drops file in System32 directory
PID:14392

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
381⤵
PID:14404

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
380⤵
PID:14360

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
379⤵
PID:14352

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
378⤵
PID:14368

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
377⤵
PID:8084

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
376⤵
- Modifies registry class
PID:8124

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
375⤵
- Modifies registry class
PID:7832

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
374⤵
PID:7728

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
373⤵
PID:7744

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
372⤵
- Modifies registry class
PID:7760

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
371⤵
PID:7792

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
370⤵
PID:7700

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
369⤵
PID:7716

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
368⤵
PID:7588

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
367⤵
PID:7604

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
366⤵
PID:14312

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
365⤵
PID:14320

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
364⤵
PID:14304

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
363⤵
PID:14268

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
362⤵
PID:14280

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
361⤵
PID:14252

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
360⤵
PID:14236

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
359⤵
PID:14204

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
358⤵
PID:14216

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
357⤵
- Modifies registry class
PID:14188

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
356⤵
PID:14196

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
355⤵
PID:14164

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
354⤵
PID:14136

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
353⤵
PID:14104

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
352⤵
PID:14092

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
351⤵
PID:14084

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
350⤵
PID:14056

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
349⤵
PID:14036

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
348⤵
PID:14044

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
347⤵
- Modifies registry class
PID:14024

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
346⤵
PID:13996

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
345⤵
PID:14004

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
344⤵
PID:14012

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
343⤵
PID:13964

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
342⤵
PID:13972

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
341⤵
PID:13980

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
340⤵
PID:13956

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
339⤵
PID:13880

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
338⤵
PID:13888

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
337⤵
PID:13896

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
336⤵
PID:13904

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
335⤵
PID:13912

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
334⤵
PID:13852

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
333⤵
PID:13828

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
332⤵
PID:13836

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
331⤵
PID:13804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13804 -s 480
332⤵
- Program crash
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13804 -s 480
332⤵
- Program crash
PID:5808

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
330⤵
- Modifies registry class
PID:13812

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
329⤵
PID:13792

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
328⤵
PID:13780

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
327⤵
PID:13768

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
326⤵
PID:13744

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
325⤵
PID:13752

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
324⤵
PID:13724

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
323⤵
PID:13732

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
322⤵
PID:13708

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
321⤵
PID:13688

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
320⤵
- Modifies registry class
PID:13700

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
319⤵
PID:13668

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
318⤵
PID:13652

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
317⤵
PID:13660

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
316⤵
- Modifies registry class
PID:13604

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
315⤵
PID:13612

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
314⤵
PID:13620

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
313⤵
PID:13628

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
312⤵
PID:13588

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
311⤵
PID:13564

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
310⤵
PID:13572

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
309⤵
PID:13552

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
308⤵
PID:13536

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
307⤵
PID:13516

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
306⤵
PID:13524

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
305⤵
PID:13496

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
304⤵
PID:13488

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
303⤵
PID:13472

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
302⤵
PID:13452

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
301⤵
PID:13460

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
300⤵
PID:13420

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
299⤵
- Modifies registry class
PID:13428

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
298⤵
PID:13404

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
297⤵
PID:13412

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
296⤵
PID:13376

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
295⤵
- Modifies registry class
PID:13388

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
294⤵
PID:13368

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
293⤵
PID:13344

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
292⤵
PID:13356

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
291⤵
PID:13332

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
290⤵
- Modifies registry class
PID:13320

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
289⤵
PID:7408

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
288⤵
PID:7464

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
287⤵
PID:7324

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
286⤵
- Drops file in System32 directory
PID:7260

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
285⤵
- Modifies registry class
PID:7176

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
284⤵
- Modifies registry class
PID:7192

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
283⤵
PID:7076

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
282⤵
PID:7120

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
281⤵
PID:6888

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
280⤵
PID:6928

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
279⤵
PID:7020

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
278⤵
PID:6456

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
277⤵
PID:6348

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
276⤵
- Drops file in System32 directory
- Modifies registry class
PID:6380

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
275⤵
PID:7164

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
274⤵
PID:4072

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
273⤵
PID:7012

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
272⤵
- Modifies registry class
PID:7136

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
271⤵
PID:6880

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
270⤵
- Modifies registry class
PID:6952

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
269⤵
PID:6852

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
268⤵
PID:6748

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
267⤵
PID:6784

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
266⤵
PID:6700

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
265⤵
PID:6716

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
264⤵
PID:6512

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
263⤵
PID:6540

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
262⤵
PID:6588

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
261⤵
- Modifies registry class
PID:6648

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
260⤵
PID:6008

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
259⤵
PID:6340

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
258⤵
- Modifies registry class
PID:6400

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
257⤵
PID:6172

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
256⤵
PID:6084

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
255⤵
PID:5928

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
254⤵
PID:5876

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
253⤵
PID:13272

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
252⤵
PID:5404

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
251⤵
PID:5324

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
250⤵
PID:13308

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
249⤵
PID:13264

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
248⤵
PID:13300

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
247⤵
PID:13204

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
246⤵
PID:13292

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
245⤵
PID:13120

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
244⤵
PID:13128

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
243⤵
PID:13136

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
242⤵
PID:13144

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
241⤵
PID:13152

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
240⤵
PID:13072

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
239⤵
PID:13220

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
238⤵
PID:13212

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
237⤵
PID:13196

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
236⤵
PID:13040

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
235⤵
PID:13048

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
234⤵
PID:13160

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
233⤵
PID:13008

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
232⤵
PID:13016

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
231⤵
PID:13024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13024 -s 476
232⤵
- Program crash
PID:620

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
230⤵
PID:12952

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
229⤵
PID:12960

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
228⤵
PID:12968

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
227⤵
PID:12976

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
226⤵
PID:12912

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
225⤵
PID:12920

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
224⤵
- Modifies registry class
PID:12904

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
223⤵
- Modifies registry class
PID:13000

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
222⤵
PID:12992

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
221⤵
PID:12944

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
220⤵
PID:12760

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
219⤵
PID:12700

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
218⤵
- Modifies registry class
PID:12888

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
217⤵
PID:12852

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
216⤵
PID:12684

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
215⤵
PID:12692

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
214⤵
PID:12784

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
213⤵
PID:12712

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
212⤵
PID:12720

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
211⤵
PID:12728

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
210⤵
- Modifies registry class
PID:12736

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
209⤵
PID:12744

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
208⤵
PID:12752

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
207⤵
PID:12768

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
206⤵
PID:12776

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
205⤵
PID:6112

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
204⤵
- Modifies registry class
PID:13188

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
203⤵
PID:13096

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
202⤵
PID:12896

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
201⤵
PID:13084

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
200⤵
PID:12880

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
199⤵
PID:13112

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
198⤵
- Modifies registry class
PID:13168

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
197⤵
PID:12836

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
196⤵
PID:12844

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
195⤵
PID:13104

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
194⤵
PID:12820

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
193⤵
PID:12636

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
192⤵
PID:12864

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
191⤵
PID:12828

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
190⤵
PID:12808

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
189⤵
PID:12676

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
188⤵
PID:12644

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
187⤵
PID:12584

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
186⤵
- Drops file in System32 directory
PID:12628

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
185⤵
PID:12576

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
184⤵
- Modifies registry class
PID:12568

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
183⤵
PID:12560

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
182⤵
PID:12544

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
181⤵
- Drops file in System32 directory
PID:12800

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
180⤵
PID:12668

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
179⤵
PID:12652

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
178⤵
PID:12660

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
177⤵
PID:12528

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
176⤵
PID:12552

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
175⤵
PID:12536

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
174⤵
PID:12520

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
173⤵
PID:12604

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
172⤵
- Drops file in System32 directory
PID:12592

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
171⤵
PID:12512

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
170⤵
PID:12500

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
169⤵
- Modifies registry class
PID:12484

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
168⤵
PID:12472

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
167⤵
PID:12460

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
166⤵
PID:5944

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
165⤵
- Modifies registry class
PID:12424

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
164⤵
PID:12372

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
163⤵
PID:12388

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
162⤵
PID:12380

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
161⤵
PID:12356

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
160⤵
PID:12308

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
159⤵
PID:12292

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
158⤵
PID:12348

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
157⤵
PID:12300

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
156⤵
- Modifies registry class
PID:6032

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
155⤵
- Drops file in System32 directory
PID:6000

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
154⤵
PID:5812

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
153⤵
PID:5828

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
152⤵
PID:5464

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
151⤵
PID:5308

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
150⤵
PID:5780

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
149⤵
PID:5712

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
148⤵
PID:5680

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
147⤵
PID:1800

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
146⤵
PID:5520

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
145⤵
- Modifies registry class
PID:5528

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
144⤵
PID:5288

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
143⤵
PID:5328

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
142⤵
PID:5172

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
141⤵
PID:804

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
140⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 428
141⤵
- Program crash
PID:16236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 428
141⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
139⤵
PID:5188

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
138⤵
PID:3744

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
137⤵
- Drops file in System32 directory
- Modifies registry class
PID:4960

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
136⤵
PID:3720

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
135⤵
PID:4204

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
134⤵
PID:1288

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
133⤵
- Drops file in System32 directory
PID:3676

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
132⤵
PID:5012

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
131⤵
PID:388

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
130⤵
PID:3764

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
129⤵
PID:4564

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
128⤵
PID:3520

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
127⤵
PID:3420

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
126⤵
PID:1180

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
125⤵
PID:2136

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
124⤵
PID:1580

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
123⤵
PID:2392

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
122⤵
PID:3688

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
121⤵
- Drops file in System32 directory
PID:4832

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
120⤵
PID:4008

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
119⤵
- Modifies registry class
PID:1572

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
118⤵
PID:1684

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
117⤵
PID:2672

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
116⤵
PID:392

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
115⤵
PID:2908

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
114⤵
PID:4640

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
113⤵
PID:2396

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
112⤵
PID:1028

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
111⤵
PID:4064

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
110⤵
PID:3432

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
109⤵
PID:3668

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
108⤵
PID:3104

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
107⤵
- Modifies registry class
PID:2372

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
106⤵
PID:2896

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
105⤵
PID:11876

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
104⤵
- Modifies registry class
PID:11840

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
103⤵
PID:11852

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
102⤵
PID:11908

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
101⤵
PID:1900

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
100⤵
PID:11932

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
99⤵
- Modifies registry class
PID:10524

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
98⤵
PID:3836

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
97⤵
PID:2152

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
96⤵
PID:2900

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
95⤵
- Drops file in System32 directory
PID:3796

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
94⤵
PID:2192

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
93⤵
PID:3372

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
92⤵
PID:3028

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
91⤵
PID:3528

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
90⤵
PID:1992

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
89⤵
PID:3320

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
88⤵
PID:4144

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
87⤵
PID:5068

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
86⤵
PID:11340

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
85⤵
PID:1600

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
84⤵
PID:12284

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
83⤵
PID:1772

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
82⤵
- Modifies registry class
PID:12276

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
81⤵
PID:3652

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
80⤵
PID:3148

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
79⤵
PID:12260

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
78⤵
- Modifies registry class
PID:12252

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
77⤵
PID:12196

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
76⤵
PID:12244

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
75⤵
PID:12188

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
74⤵
PID:12232

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
73⤵
PID:12180

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
72⤵
PID:12216

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
71⤵
PID:12224

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
70⤵
PID:12268

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
69⤵
PID:12204

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
68⤵
PID:12148

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
67⤵
PID:12156

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
66⤵
- Suspicious use of SetWindowsHookEx
PID:12140

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
65⤵
PID:12132

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
64⤵
- Modifies registry class
PID:12124

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
63⤵
PID:12164

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
62⤵
PID:12116

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
61⤵
- Suspicious use of SetWindowsHookEx
PID:12104

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
60⤵
- Suspicious use of SetWindowsHookEx
PID:12092

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
59⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:12068

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
58⤵
- Suspicious use of SetWindowsHookEx
PID:12056

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
57⤵
- Suspicious use of SetWindowsHookEx
PID:12028

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
56⤵
- Suspicious use of SetWindowsHookEx
PID:12004

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
55⤵
- Suspicious use of SetWindowsHookEx
PID:11984

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
54⤵
- Suspicious use of SetWindowsHookEx
PID:11968

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
53⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11952

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
52⤵
- Suspicious use of SetWindowsHookEx
PID:11936

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
51⤵
- Suspicious use of SetWindowsHookEx
PID:11916

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
50⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11892

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
49⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11864

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
48⤵
- Suspicious use of SetWindowsHookEx
PID:11832

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
47⤵
- Suspicious use of SetWindowsHookEx
PID:11816

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
46⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11800

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
45⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11780

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
44⤵
- Suspicious use of SetWindowsHookEx
PID:11764

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
43⤵
- Suspicious use of SetWindowsHookEx
PID:11748

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
42⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:11728

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
41⤵
- Suspicious use of SetWindowsHookEx
PID:11712

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
40⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:11696

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
39⤵
- Suspicious use of SetWindowsHookEx
PID:11680

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
38⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11660

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
37⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11644

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
36⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11628

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
35⤵
- Suspicious use of SetWindowsHookEx
PID:11608

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
34⤵
- Suspicious use of SetWindowsHookEx
PID:11592

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
33⤵
- Suspicious use of SetWindowsHookEx
PID:11572

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
32⤵
- Suspicious use of SetWindowsHookEx
PID:11556

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
31⤵
- Suspicious use of SetWindowsHookEx
PID:11540

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
30⤵
- Suspicious use of SetWindowsHookEx
PID:11524

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
29⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11504

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
28⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11488

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
27⤵
- Suspicious use of SetWindowsHookEx
PID:11464

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
26⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11456

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
25⤵
- Suspicious use of SetWindowsHookEx
PID:11440

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
24⤵
- Suspicious use of SetWindowsHookEx
PID:11424

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
23⤵
- Suspicious use of SetWindowsHookEx
PID:11408

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
22⤵
- Suspicious use of SetWindowsHookEx
PID:11392

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
21⤵
- Suspicious use of SetWindowsHookEx
PID:11376

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
20⤵
- Suspicious use of SetWindowsHookEx
PID:11360

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
19⤵
- Suspicious use of SetWindowsHookEx
PID:11344

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
18⤵
- Suspicious use of SetWindowsHookEx
PID:11324

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
17⤵
- Suspicious use of SetWindowsHookEx
PID:11308

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
16⤵
- Suspicious use of SetWindowsHookEx
PID:11284

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
15⤵
- Suspicious use of SetWindowsHookEx
PID:380

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
14⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2056

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
13⤵
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
12⤵
- Suspicious use of SetWindowsHookEx
PID:11136

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
11⤵
- Suspicious use of SetWindowsHookEx
PID:11084

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
10⤵
- Suspicious use of SetWindowsHookEx
PID:4696

C:\Windows\SysWOW64\IEXPLORE .EXE
"C:\Windows\system32\IEXPLORE .EXE"
11⤵
- Suspicious use of SetWindowsHookEx
PID:11276

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
9⤵
- Suspicious use of SetWindowsHookEx
PID:4712

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
8⤵
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
7⤵
- Suspicious use of SetWindowsHookEx
PID:11068

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
6⤵
- Suspicious use of SetWindowsHookEx
PID:11016

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
5⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:10976

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
4⤵
- Suspicious use of SetWindowsHookEx
PID:10924

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
3⤵
- Suspicious use of SetWindowsHookEx
PID:10540

C:\Windows\SysWOW64\system.exe
C:\Windows\system32\system.exe
2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:10388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10340 -ip 10340
1⤵
PID:10488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 10340 -ip 10340
1⤵
PID:11840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5140 -ip 5140
1⤵
PID:12872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 13024 -ip 13024
1⤵
PID:15476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 13804 -ip 13804
1⤵
PID:15748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 480
1⤵
- Program crash
PID:11532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 480
1⤵
- Program crash
PID:16232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7604 -ip 7604
1⤵
PID:15556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\ABCHELP.EXE
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\DirectX.exe
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\WINhelp32.exe
Filesize
96KB

MD5
16df5cdb0dd3701f287c5f810bd5b1cd

SHA1
6f638d0ec31edc6912fb4f5eeeaa37403a782e42

SHA256
3c1684f184f6ece0d9a5c66d764e35b2348813632556bdeb95d32e378afb2b3a

SHA512
807467934f957024c7e9211d1f6575f605fce0aacd7cc55e1dad9b5e83bd086bb4cf85ec830a0cf87e2e5cf98c0e544e23a422c0acc049f3f44c39704cca24ee

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
C:\Windows\SysWOW64\system.exe
Filesize
55KB

MD5
ab5d061d937b27f0d9d0c0f34bd848e8

SHA1
89627e279a4da83ed10d4ab0350a078f829242ec

SHA256
ff6b3faedf30095fea25d6973f60808337b91e31054c6bcfeafe4170e3ed944e

SHA512
9915655e72eb932c417dddd6bf357d4d2860bed677894d621e40202ed790a3f2d7101315a63817dc95af311b752bfe6cc4ccb43834e983d7a07f7c8f31a56dd7

Download Submit
memory/508-267-0x0000000000000000-mapping.dmp

Download
memory/508-290-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/620-262-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/620-237-0x0000000000000000-mapping.dmp

Download
memory/652-179-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/652-147-0x0000000000000000-mapping.dmp

Download
memory/768-308-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/768-282-0x0000000000000000-mapping.dmp

Download
memory/772-313-0x0000000000000000-mapping.dmp

Download
memory/868-228-0x0000000000000000-mapping.dmp

Download
memory/868-259-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/916-180-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/916-150-0x0000000000000000-mapping.dmp

Download
memory/924-296-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/924-272-0x0000000000000000-mapping.dmp

Download
memory/1192-188-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1192-165-0x0000000000000000-mapping.dmp

Download
memory/1272-256-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1272-222-0x0000000000000000-mapping.dmp

Download
memory/1380-275-0x0000000000000000-mapping.dmp

Download
memory/1380-300-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1392-241-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1392-130-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1720-210-0x0000000000000000-mapping.dmp

Download
memory/1720-251-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1808-178-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1808-144-0x0000000000000000-mapping.dmp

Download
memory/1836-269-0x0000000000000000-mapping.dmp

Download
memory/1836-292-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1904-247-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1904-198-0x0000000000000000-mapping.dmp

Download
memory/1944-176-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1944-141-0x0000000000000000-mapping.dmp

Download
memory/1968-297-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1968-273-0x0000000000000000-mapping.dmp

Download
memory/2012-295-0x0000000000000000-mapping.dmp

Download
memory/2012-316-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2028-317-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2028-299-0x0000000000000000-mapping.dmp

Download
memory/2076-187-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2076-162-0x0000000000000000-mapping.dmp

Download
memory/2092-277-0x0000000000000000-mapping.dmp

Download
memory/2092-302-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2164-279-0x0000000000000000-mapping.dmp

Download
memory/2164-304-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2184-239-0x0000000000000000-mapping.dmp

Download
memory/2184-264-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2196-190-0x0000000000000000-mapping.dmp

Download
memory/2196-244-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2292-281-0x0000000000000000-mapping.dmp

Download
memory/2292-307-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2308-271-0x0000000000000000-mapping.dmp

Download
memory/2308-294-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2312-131-0x0000000000000000-mapping.dmp

Download
memory/2312-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2320-312-0x0000000000000000-mapping.dmp

Download
memory/2320-321-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2336-156-0x0000000000000000-mapping.dmp

Download
memory/2336-185-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2384-191-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2384-168-0x0000000000000000-mapping.dmp

Download
memory/2412-248-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2412-201-0x0000000000000000-mapping.dmp

Download
memory/2648-310-0x0000000000000000-mapping.dmp

Download
memory/2648-319-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2776-159-0x0000000000000000-mapping.dmp

Download
memory/2776-186-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2960-287-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2960-263-0x0000000000000000-mapping.dmp

Download
memory/3076-204-0x0000000000000000-mapping.dmp

Download
memory/3076-249-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3152-288-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3152-266-0x0000000000000000-mapping.dmp

Download
memory/3160-216-0x0000000000000000-mapping.dmp

Download
memory/3160-254-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3164-306-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3164-280-0x0000000000000000-mapping.dmp

Download
memory/3256-195-0x0000000000000000-mapping.dmp

Download
memory/3256-246-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3264-257-0x0000000000000000-mapping.dmp

Download
memory/3264-286-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3404-219-0x0000000000000000-mapping.dmp

Download
memory/3404-255-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3516-314-0x0000000000000000-mapping.dmp

Download
memory/3632-318-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3632-305-0x0000000000000000-mapping.dmp

Download
memory/3684-207-0x0000000000000000-mapping.dmp

Download
memory/3684-250-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3780-240-0x0000000000000000-mapping.dmp

Download
memory/3780-265-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3816-283-0x0000000000000000-mapping.dmp

Download
memory/3816-309-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3856-320-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3856-311-0x0000000000000000-mapping.dmp

Download
memory/3928-258-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3928-225-0x0000000000000000-mapping.dmp

Download
memory/4224-268-0x0000000000000000-mapping.dmp

Download
memory/4224-291-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4276-276-0x0000000000000000-mapping.dmp

Download
memory/4276-301-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4288-298-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4288-274-0x0000000000000000-mapping.dmp

Download
memory/4368-234-0x0000000000000000-mapping.dmp

Download
memory/4368-261-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4468-315-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4468-289-0x0000000000000000-mapping.dmp

Download
memory/4492-231-0x0000000000000000-mapping.dmp

Download
memory/4492-260-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4524-213-0x0000000000000000-mapping.dmp

Download
memory/4524-253-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4632-174-0x0000000000000000-mapping.dmp

Download
memory/4632-242-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4684-182-0x0000000000000000-mapping.dmp

Download
memory/4684-243-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4700-192-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4700-171-0x0000000000000000-mapping.dmp

Download
memory/4724-153-0x0000000000000000-mapping.dmp

Download
memory/4724-183-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4756-245-0x0000000000000000-mapping.dmp

Download
memory/4756-284-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4776-270-0x0000000000000000-mapping.dmp

Download
memory/4776-293-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4808-175-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4808-138-0x0000000000000000-mapping.dmp

Download
memory/5052-285-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5052-252-0x0000000000000000-mapping.dmp

Download
memory/5100-303-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5100-278-0x0000000000000000-mapping.dmp

Download