41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
Size

72KB
MD5

1cd970dfd5d94caace6c686a0b0cb13c
SHA1

d5ded78e026eb7733f19a34ea50e0349b5a130bb
SHA256

41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3
SHA512

85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce
SSDEEP

1536:Z+KnjJ0ty9cHMQ9Lqc6nKQMt5tdnzLeP4YnOjb:YKnueKLZvdzLeNO/

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe

Executes dropped EXE 64 IoCs

pid	Process
1808	winupd32.exe
1732	winupd32.exe
1048	winupd32.exe
560	winupd32.exe
1596	winupd32.exe
1420	winupd32.exe
1128	winupd32.exe
1996	winupd32.exe
1684	winupd32.exe
1668	winupd32.exe
1552	winupd32.exe
1768	winupd32.exe
980	winupd32.exe
896	winupd32.exe
948	winupd32.exe
1716	winupd32.exe
1088	winupd32.exe
1048	winupd32.exe
1564	winupd32.exe
364	winupd32.exe
1676	winupd32.exe
1040	winupd32.exe
1132	winupd32.exe
1532	winupd32.exe
288	winupd32.exe
1668	winupd32.exe
1392	winupd32.exe
316	winupd32.exe
1608	winupd32.exe
1488	winupd32.exe
240	winupd32.exe
616	winupd32.exe
1812	winupd32.exe
524	winupd32.exe
320	winupd32.exe
560	winupd32.exe
1060	winupd32.exe
1524	winupd32.exe
1596	winupd32.exe
1620	winupd32.exe
1888	winupd32.exe
2000	winupd32.exe
660	winupd32.exe
284	winupd32.exe
1648	winupd32.exe
1720	winupd32.exe
1364	winupd32.exe
1296	winupd32.exe
1224	winupd32.exe
1960	winupd32.exe
948	winupd32.exe
1808	winupd32.exe
1928	winupd32.exe
1088	winupd32.exe
1080	winupd32.exe
1948	winupd32.exe
1312	winupd32.exe
1952	winupd32.exe
1128	winupd32.exe
1040	winupd32.exe
1876	winupd32.exe
1980	winupd32.exe
1304	winupd32.exe
1580	winupd32.exe

Loads dropped DLL 64 IoCs

pid	Process
1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
1808	winupd32.exe
1808	winupd32.exe
1732	winupd32.exe
1732	winupd32.exe
1048	winupd32.exe
1048	winupd32.exe
560	winupd32.exe
560	winupd32.exe
1596	winupd32.exe
1596	winupd32.exe
1420	winupd32.exe
1420	winupd32.exe
1128	winupd32.exe
1128	winupd32.exe
1996	winupd32.exe
1996	winupd32.exe
1684	winupd32.exe
1684	winupd32.exe
1668	winupd32.exe
1668	winupd32.exe
1552	winupd32.exe
1552	winupd32.exe
1768	winupd32.exe
1768	winupd32.exe
980	winupd32.exe
980	winupd32.exe
896	winupd32.exe
896	winupd32.exe
948	winupd32.exe
948	winupd32.exe
1716	winupd32.exe
1716	winupd32.exe
1088	winupd32.exe
1088	winupd32.exe
1048	winupd32.exe
1048	winupd32.exe
1564	winupd32.exe
1564	winupd32.exe
364	winupd32.exe
364	winupd32.exe
1676	winupd32.exe
1676	winupd32.exe
1040	winupd32.exe
1040	winupd32.exe
1132	winupd32.exe
1132	winupd32.exe
1532	winupd32.exe
1532	winupd32.exe
288	winupd32.exe
288	winupd32.exe
1668	winupd32.exe
1668	winupd32.exe
1392	winupd32.exe
1392	winupd32.exe
316	winupd32.exe
316	winupd32.exe
1608	winupd32.exe
1608	winupd32.exe
1488	winupd32.exe
1488	winupd32.exe
240	winupd32.exe
240	winupd32.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "winupd32.exe"	winupd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File opened for modification	C:\Windows\SysWOW64\winupd32.exe	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
1808	winupd32.exe
1732	winupd32.exe
1048	winupd32.exe
560	winupd32.exe
1596	winupd32.exe
1420	winupd32.exe
1996	winupd32.exe
1684	winupd32.exe
1668	winupd32.exe
1552	winupd32.exe
1768	winupd32.exe
980	winupd32.exe
896	winupd32.exe
948	winupd32.exe
1716	winupd32.exe
1088	winupd32.exe
1048	winupd32.exe
1564	winupd32.exe
364	winupd32.exe
1676	winupd32.exe
1040	winupd32.exe
1132	winupd32.exe
1532	winupd32.exe
288	winupd32.exe
1668	winupd32.exe
1392	winupd32.exe
316	winupd32.exe
1608	winupd32.exe
1488	winupd32.exe
240	winupd32.exe
616	winupd32.exe
1812	winupd32.exe
524	winupd32.exe
320	winupd32.exe
560	winupd32.exe
1060	winupd32.exe
1524	winupd32.exe
1596	winupd32.exe
1620	winupd32.exe
1888	winupd32.exe
2000	winupd32.exe
660	winupd32.exe
284	winupd32.exe
1648	winupd32.exe
1720	winupd32.exe
1364	winupd32.exe
1296	winupd32.exe
1224	winupd32.exe
1960	winupd32.exe
948	winupd32.exe
1808	winupd32.exe
1928	winupd32.exe
1088	winupd32.exe
1080	winupd32.exe
1948	winupd32.exe
1312	winupd32.exe
1952	winupd32.exe
1128	winupd32.exe
1040	winupd32.exe
1876	winupd32.exe
1304	winupd32.exe
1580	winupd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1808	1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe	27
PID 1368 wrote to memory of 1808	1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe	27
PID 1368 wrote to memory of 1808	1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe	27
PID 1368 wrote to memory of 1808	1368	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe	27
PID 1808 wrote to memory of 1732	1808	winupd32.exe	28
PID 1808 wrote to memory of 1732	1808	winupd32.exe	28
PID 1808 wrote to memory of 1732	1808	winupd32.exe	28
PID 1808 wrote to memory of 1732	1808	winupd32.exe	28
PID 1732 wrote to memory of 1048	1732	winupd32.exe	29
PID 1732 wrote to memory of 1048	1732	winupd32.exe	29
PID 1732 wrote to memory of 1048	1732	winupd32.exe	29
PID 1732 wrote to memory of 1048	1732	winupd32.exe	29
PID 1048 wrote to memory of 560	1048	winupd32.exe	30
PID 1048 wrote to memory of 560	1048	winupd32.exe	30
PID 1048 wrote to memory of 560	1048	winupd32.exe	30
PID 1048 wrote to memory of 560	1048	winupd32.exe	30
PID 560 wrote to memory of 1596	560	winupd32.exe	31
PID 560 wrote to memory of 1596	560	winupd32.exe	31
PID 560 wrote to memory of 1596	560	winupd32.exe	31
PID 560 wrote to memory of 1596	560	winupd32.exe	31
PID 1596 wrote to memory of 1420	1596	winupd32.exe	32
PID 1596 wrote to memory of 1420	1596	winupd32.exe	32
PID 1596 wrote to memory of 1420	1596	winupd32.exe	32
PID 1596 wrote to memory of 1420	1596	winupd32.exe	32
PID 1420 wrote to memory of 1128	1420	winupd32.exe	33
PID 1420 wrote to memory of 1128	1420	winupd32.exe	33
PID 1420 wrote to memory of 1128	1420	winupd32.exe	33
PID 1420 wrote to memory of 1128	1420	winupd32.exe	33
PID 1128 wrote to memory of 1996	1128	winupd32.exe	34
PID 1128 wrote to memory of 1996	1128	winupd32.exe	34
PID 1128 wrote to memory of 1996	1128	winupd32.exe	34
PID 1128 wrote to memory of 1996	1128	winupd32.exe	34
PID 1996 wrote to memory of 1684	1996	winupd32.exe	35
PID 1996 wrote to memory of 1684	1996	winupd32.exe	35
PID 1996 wrote to memory of 1684	1996	winupd32.exe	35
PID 1996 wrote to memory of 1684	1996	winupd32.exe	35
PID 1684 wrote to memory of 1668	1684	winupd32.exe	36
PID 1684 wrote to memory of 1668	1684	winupd32.exe	36
PID 1684 wrote to memory of 1668	1684	winupd32.exe	36
PID 1684 wrote to memory of 1668	1684	winupd32.exe	36
PID 1668 wrote to memory of 1552	1668	winupd32.exe	37
PID 1668 wrote to memory of 1552	1668	winupd32.exe	37
PID 1668 wrote to memory of 1552	1668	winupd32.exe	37
PID 1668 wrote to memory of 1552	1668	winupd32.exe	37
PID 1552 wrote to memory of 1768	1552	winupd32.exe	38
PID 1552 wrote to memory of 1768	1552	winupd32.exe	38
PID 1552 wrote to memory of 1768	1552	winupd32.exe	38
PID 1552 wrote to memory of 1768	1552	winupd32.exe	38
PID 1768 wrote to memory of 980	1768	winupd32.exe	39
PID 1768 wrote to memory of 980	1768	winupd32.exe	39
PID 1768 wrote to memory of 980	1768	winupd32.exe	39
PID 1768 wrote to memory of 980	1768	winupd32.exe	39
PID 980 wrote to memory of 896	980	winupd32.exe	40
PID 980 wrote to memory of 896	980	winupd32.exe	40
PID 980 wrote to memory of 896	980	winupd32.exe	40
PID 980 wrote to memory of 896	980	winupd32.exe	40
PID 896 wrote to memory of 948	896	winupd32.exe	41
PID 896 wrote to memory of 948	896	winupd32.exe	41
PID 896 wrote to memory of 948	896	winupd32.exe	41
PID 896 wrote to memory of 948	896	winupd32.exe	41
PID 948 wrote to memory of 1716	948	winupd32.exe	42
PID 948 wrote to memory of 1716	948	winupd32.exe	42
PID 948 wrote to memory of 1716	948	winupd32.exe	42
PID 948 wrote to memory of 1716	948	winupd32.exe	42

C:\Users\Admin\AppData\Local\Temp\41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
"C:\Users\Admin\AppData\Local\Temp\41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\winupd32.exe
  C:\Windows\system32\winupd32.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\winupd32.exe
    C:\Windows\system32\winupd32.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\SysWOW64\winupd32.exe
      C:\Windows\system32\winupd32.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1048
    - - C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:560
      - C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:896
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1716
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1088
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1048
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1564
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:364
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1676
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1040
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1132
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:288
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1668
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1392
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:316
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1608
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1488
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:240
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        33⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:616
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1812
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:524
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:320
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:560
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        38⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1060
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1524
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        40⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1596
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1620
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1888
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2000
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        44⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:660
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        45⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:284
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        46⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1648
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        47⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1720
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        48⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1364
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        49⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1296
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1960
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:948
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1808
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        54⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1928
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1088
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1080
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1948
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        58⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1312
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1952
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1128
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        61⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1040
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1876
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        63⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1980
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1304
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        65⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1580
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        66⤵
        Drops file in System32 directory
        
        PID:1692
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        67⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1284
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        68⤵
        Drops file in System32 directory
        
        PID:1608
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        69⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        70⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1712
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        71⤵
        Drops file in System32 directory
        
        PID:820
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        72⤵
        Drops file in System32 directory
        
        PID:616
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        73⤵
        Adds Run key to start application
        
        PID:1084
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        74⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1500
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        75⤵
        Adds Run key to start application
        
        PID:1628
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        76⤵
        Drops file in System32 directory
        
        PID:1088
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        77⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1080
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        78⤵
        Adds Run key to start application
        
        PID:1932
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        79⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1956
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        80⤵
        Adds Run key to start application
        
        PID:1676
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        81⤵
        Drops file in System32 directory
        
        PID:808
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        82⤵
        Drops file in System32 directory
        
        PID:1752
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        83⤵
        Adds Run key to start application
        
        PID:1688
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        84⤵
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        85⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        86⤵
        Drops file in System32 directory
        
        PID:1604
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        87⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        88⤵
        Drops file in System32 directory
        
        PID:1692
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        89⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        90⤵
        Drops file in System32 directory
        
        PID:1608
        
        C:\Windows\SysWOW64\winupd32.exe
        
        C:\Windows\system32\winupd32.exe
        91⤵
        
        PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
90a48da259c2a59382cf6cdf90e3f7e1

SHA1
55f040d1cb42fdd45d7f354b5d76305e6d1d53df

SHA256
eed931b4a5f4149da294e096770b20669f49e71793e35e5f2831e863ffb79026

SHA512
d2c1ab3189f2eeca22a0e466f80169380bf15cd03ac4f921313c4dcdae37dd13431296d0898659ae9509a7ff479926d71ab9cdffcc2044fad53dca62a30213df

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
memory/240-212-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/284-249-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/288-195-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/316-203-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/320-224-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/364-181-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/524-221-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/560-227-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/560-86-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/616-215-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/616-316-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/660-246-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/820-314-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/840-310-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/896-146-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/948-151-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/980-140-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1040-294-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1048-80-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1048-170-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1060-230-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1080-279-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1084-318-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1088-163-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1128-103-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1128-291-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1132-189-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1224-264-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1296-261-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1304-302-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1312-285-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1364-258-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1368-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1368-61-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1420-98-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1488-209-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1532-192-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1552-127-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1564-175-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1580-304-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1596-235-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1596-92-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1608-206-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1620-238-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1648-252-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1668-121-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1668-198-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1676-184-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1684-116-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1692-306-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1712-312-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1716-158-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1720-255-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1732-74-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1768-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1808-271-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1808-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1812-218-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1928-274-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1948-282-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1952-288-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1980-299-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-109-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2000-243-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download