Overview

overview

10

Static

static

3

71abcd053e...8f.exe

windows7-x64

10

71abcd053e...8f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 13:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    71abcd053e767e8463bd377c5c2b908f.exe

  • Size

    145KB

  • MD5

    71abcd053e767e8463bd377c5c2b908f

  • SHA1

    407e033b5effa9e02d148cfdc1edc73230f39274

  • SHA256

    77ee252b07e68dc35fc20b9c8b07b2bcce38d45912d9420239578a5e04131b8f

  • SHA512

    68e736496edcd412831eb7c3c526f2bc6eca14f007837d3ae15d187f312ee72afa3dddba33958d310c88ee07320f56035b07d82df2d580a28bdcb4f323158a1e

  • SSDEEP

    3072:/juq3BQoNypn9hvkwXtvmZ6Q4YxmiPkCaepM9GPw:/jdz0n9hvkwXtvmxmwXK94w

Score
10/10
persistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Modifies WinLogon 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71abcd053e767e8463bd377c5c2b908f.exe
    "C:\Users\Admin\AppData\Local\Temp\71abcd053e767e8463bd377c5c2b908f.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\SysWOW64\wyomuh.exe
      C:\Windows\system32\wyomuh.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Windows\SysWOW64\abkvku.exe
        C:\Windows\system32\abkvku.exe
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks for any installed AV software in registry
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\SysWOW64\exnltq.exe
          C:\Windows\system32\exnltq.exe
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks for any installed AV software in registry
          • Modifies WinLogon
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Windows\SysWOW64\bnqlwu.exe
            C:\Windows\system32\bnqlwu.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks for any installed AV software in registry
            • Modifies WinLogon
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2856
            • C:\Windows\SysWOW64\rmmlht.exe
              C:\Windows\system32\rmmlht.exe
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies WinLogon
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2744
              • C:\Windows\SysWOW64\pbnqww.exe
                C:\Windows\system32\pbnqww.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks for any installed AV software in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1276
                • C:\Windows\SysWOW64\zntkyr.exe
                  C:\Windows\system32\zntkyr.exe
                  8⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks for any installed AV software in registry
                  • Modifies WinLogon
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2624
                  • C:\Windows\SysWOW64\nqgejp.exe
                    C:\Windows\system32\nqgejp.exe
                    9⤵
                    • Modifies WinLogon for persistence
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks for any installed AV software in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2528
                    • C:\Windows\SysWOW64\lqkwuk.exe
                      C:\Windows\system32\lqkwuk.exe
                      10⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2984
                      • C:\Windows\SysWOW64\xqmehw.exe
                        C:\Windows\system32\xqmehw.exe
                        11⤵
                        • Modifies WinLogon for persistence
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2892
                        • C:\Windows\SysWOW64\xpsqov.exe
                          C:\Windows\system32\xpsqov.exe
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks for any installed AV software in registry
                          • Modifies WinLogon
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1716
                          • C:\Windows\SysWOW64\rtjmse.exe
                            C:\Windows\system32\rtjmse.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks for any installed AV software in registry
                            • Modifies WinLogon
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2772
                            • C:\Windows\SysWOW64\fczyxf.exe
                              C:\Windows\system32\fczyxf.exe
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks for any installed AV software in registry
                              • Modifies WinLogon
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2016
                              • C:\Windows\SysWOW64\nklnkq.exe
                                C:\Windows\system32\nklnkq.exe
                                15⤵
                                • Modifies WinLogon for persistence
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies WinLogon
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:324
                                • C:\Windows\SysWOW64\tbwjod.exe
                                  C:\Windows\system32\tbwjod.exe
                                  16⤵
                                  • Modifies WinLogon for persistence
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks for any installed AV software in registry
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:1476
                                  • C:\Windows\SysWOW64\qgiqki.exe
                                    C:\Windows\system32\qgiqki.exe
                                    17⤵
                                    • Modifies WinLogon for persistence
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks for any installed AV software in registry
                                    • Modifies WinLogon
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1688
                                    • C:\Windows\SysWOW64\soeeyk.exe
                                      C:\Windows\system32\soeeyk.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks for any installed AV software in registry
                                      • Modifies WinLogon
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2200
                                      • C:\Windows\SysWOW64\ynsewa.exe
                                        C:\Windows\system32\ynsewa.exe
                                        19⤵
                                        • Modifies WinLogon for persistence
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks for any installed AV software in registry
                                        • Modifies WinLogon
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2300
                                        • C:\Windows\SysWOW64\pjlgkp.exe
                                          C:\Windows\system32\pjlgkp.exe
                                          20⤵
                                          • Modifies WinLogon for persistence
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Modifies WinLogon
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1248
                                          • C:\Windows\SysWOW64\yzxpjg.exe
                                            C:\Windows\system32\yzxpjg.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Checks for any installed AV software in registry
                                            • Drops file in System32 directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1340
                                            • C:\Windows\SysWOW64\bcezdp.exe
                                              C:\Windows\system32\bcezdp.exe
                                              22⤵
                                              • Modifies WinLogon for persistence
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Checks for any installed AV software in registry
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1628
                                              • C:\Windows\SysWOW64\atfqxq.exe
                                                C:\Windows\system32\atfqxq.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Checks for any installed AV software in registry
                                                • Modifies WinLogon
                                                • Drops file in System32 directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1848
                                                • C:\Windows\SysWOW64\sdvnha.exe
                                                  C:\Windows\system32\sdvnha.exe
                                                  24⤵
                                                  • Modifies WinLogon for persistence
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Checks for any installed AV software in registry
                                                  • Modifies WinLogon
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1068
                                                  • C:\Windows\SysWOW64\rsadyr.exe
                                                    C:\Windows\system32\rsadyr.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Checks for any installed AV software in registry
                                                    • Modifies WinLogon
                                                    • Drops file in System32 directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:620
                                                    • C:\Windows\SysWOW64\alttwn.exe
                                                      C:\Windows\system32\alttwn.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Checks for any installed AV software in registry
                                                      • Modifies WinLogon
                                                      • Drops file in System32 directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1976
                                                      • C:\Windows\SysWOW64\hrubkg.exe
                                                        C:\Windows\system32\hrubkg.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks for any installed AV software in registry
                                                        • Modifies WinLogon
                                                        • Drops file in System32 directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2400
                                                        • C:\Windows\SysWOW64\emcdai.exe
                                                          C:\Windows\system32\emcdai.exe
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2516
                                                          • C:\Windows\SysWOW64\najtqy.exe
                                                            C:\Windows\system32\najtqy.exe
                                                            29⤵
                                                            • Modifies WinLogon for persistence
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks for any installed AV software in registry
                                                            • Modifies WinLogon
                                                            • Drops file in System32 directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:280
                                                            • C:\Windows\SysWOW64\glrzxv.exe
                                                              C:\Windows\system32\glrzxv.exe
                                                              30⤵
                                                              • Modifies WinLogon for persistence
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks for any installed AV software in registry
                                                              • Modifies WinLogon
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1612
                                                              • C:\Windows\SysWOW64\qhkumx.exe
                                                                C:\Windows\system32\qhkumx.exe
                                                                31⤵
                                                                • Modifies WinLogon for persistence
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in System32 directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2988
                                                                • C:\Windows\SysWOW64\jhvsrj.exe
                                                                  C:\Windows\system32\jhvsrj.exe
                                                                  32⤵
                                                                  • Modifies WinLogon for persistence
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Checks for any installed AV software in registry
                                                                  • Modifies WinLogon
                                                                  • Drops file in System32 directory
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2820
                                                                  • C:\Windows\SysWOW64\qzuzfg.exe
                                                                    C:\Windows\system32\qzuzfg.exe
                                                                    33⤵
                                                                    • Modifies WinLogon for persistence
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Checks for any installed AV software in registry
                                                                    • Modifies WinLogon
                                                                    • Drops file in System32 directory
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2736
                                                                    • C:\Windows\SysWOW64\ehnglz.exe
                                                                      C:\Windows\system32\ehnglz.exe
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Modifies WinLogon
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1692
                                                                      • C:\Windows\SysWOW64\moiflh.exe
                                                                        C:\Windows\system32\moiflh.exe
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks for any installed AV software in registry
                                                                        • Modifies WinLogon
                                                                        • Drops file in System32 directory
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2344
                                                                        • C:\Windows\SysWOW64\xqgozk.exe
                                                                          C:\Windows\system32\xqgozk.exe
                                                                          36⤵
                                                                          • Modifies WinLogon for persistence
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks for any installed AV software in registry
                                                                          • Modifies WinLogon
                                                                          • Drops file in System32 directory
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2824
                                                                          • C:\Windows\SysWOW64\yakiuy.exe
                                                                            C:\Windows\system32\yakiuy.exe
                                                                            37⤵
                                                                            • Modifies WinLogon for persistence
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Checks for any installed AV software in registry
                                                                            • Modifies WinLogon
                                                                            • Drops file in System32 directory
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2552
                                                                            • C:\Windows\SysWOW64\yzisan.exe
                                                                              C:\Windows\system32\yzisan.exe
                                                                              38⤵
                                                                              • Modifies WinLogon for persistence
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Checks for any installed AV software in registry
                                                                              • Modifies WinLogon
                                                                              • Drops file in System32 directory
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2592
                                                                              • C:\Windows\SysWOW64\zmfhks.exe
                                                                                C:\Windows\system32\zmfhks.exe
                                                                                39⤵
                                                                                • Modifies WinLogon for persistence
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Checks for any installed AV software in registry
                                                                                • Modifies WinLogon
                                                                                • Drops file in System32 directory
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1916
                                                                                • C:\Windows\SysWOW64\wmjkdy.exe
                                                                                  C:\Windows\system32\wmjkdy.exe
                                                                                  40⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2436
                                                                                  • C:\Windows\SysWOW64\ifclwg.exe
                                                                                    C:\Windows\system32\ifclwg.exe
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Checks for any installed AV software in registry
                                                                                    • Modifies WinLogon
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:780
                                                                                    • C:\Windows\SysWOW64\qcgcan.exe
                                                                                      C:\Windows\system32\qcgcan.exe
                                                                                      42⤵
                                                                                      • Modifies WinLogon for persistence
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Checks for any installed AV software in registry
                                                                                      • Modifies WinLogon
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2960
                                                                                      • C:\Windows\SysWOW64\nlaflz.exe
                                                                                        C:\Windows\system32\nlaflz.exe
                                                                                        43⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Modifies WinLogon
                                                                                        • Drops file in System32 directory
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2964
                                                                                        • C:\Windows\SysWOW64\akogfo.exe
                                                                                          C:\Windows\system32\akogfo.exe
                                                                                          44⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks for any installed AV software in registry
                                                                                          • Modifies WinLogon
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2140
                                                                                          • C:\Windows\SysWOW64\ajnnlt.exe
                                                                                            C:\Windows\system32\ajnnlt.exe
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Checks for any installed AV software in registry
                                                                                            • Modifies WinLogon
                                                                                            • Drops file in System32 directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2880
                                                                                            • C:\Windows\SysWOW64\moojmz.exe
                                                                                              C:\Windows\system32\moojmz.exe
                                                                                              46⤵
                                                                                              • Modifies WinLogon for persistence
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Checks for any installed AV software in registry
                                                                                              • Modifies WinLogon
                                                                                              • Drops file in System32 directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2020
                                                                                              • C:\Windows\SysWOW64\gcsgds.exe
                                                                                                C:\Windows\system32\gcsgds.exe
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks for any installed AV software in registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1468
                                                                                                • C:\Windows\SysWOW64\mwzsdb.exe
                                                                                                  C:\Windows\system32\mwzsdb.exe
                                                                                                  48⤵
                                                                                                  • Modifies WinLogon for persistence
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Checks for any installed AV software in registry
                                                                                                  • Modifies WinLogon
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1984
                                                                                                  • C:\Windows\SysWOW64\kbeltb.exe
                                                                                                    C:\Windows\system32\kbeltb.exe
                                                                                                    49⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1304
                                                                                                    • C:\Windows\SysWOW64\iybhfi.exe
                                                                                                      C:\Windows\system32\iybhfi.exe
                                                                                                      50⤵
                                                                                                      • Modifies WinLogon for persistence
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Checks for any installed AV software in registry
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1708
                                                                                                      • C:\Windows\SysWOW64\uihjnq.exe
                                                                                                        C:\Windows\system32\uihjnq.exe
                                                                                                        51⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Checks for any installed AV software in registry
                                                                                                        • Modifies WinLogon
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1560
                                                                                                        • C:\Windows\SysWOW64\weuokn.exe
                                                                                                          C:\Windows\system32\weuokn.exe
                                                                                                          52⤵
                                                                                                          • Modifies WinLogon for persistence
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Checks for any installed AV software in registry
                                                                                                          • Modifies WinLogon
                                                                                                          • Drops file in System32 directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3032
                                                                                                          • C:\Windows\SysWOW64\ssuydi.exe
                                                                                                            C:\Windows\system32\ssuydi.exe
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks for any installed AV software in registry
                                                                                                            • Modifies WinLogon
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3016
                                                                                                            • C:\Windows\SysWOW64\qaiafp.exe
                                                                                                              C:\Windows\system32\qaiafp.exe
                                                                                                              54⤵
                                                                                                              • Modifies WinLogon for persistence
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • Checks for any installed AV software in registry
                                                                                                              • Modifies WinLogon
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:1156
                                                                                                              • C:\Windows\SysWOW64\turrnr.exe
                                                                                                                C:\Windows\system32\turrnr.exe
                                                                                                                55⤵
                                                                                                                • Modifies WinLogon for persistence
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • Checks for any installed AV software in registry
                                                                                                                • Modifies WinLogon
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2320
                                                                                                                • C:\Windows\SysWOW64\deouyw.exe
                                                                                                                  C:\Windows\system32\deouyw.exe
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                  • Modifies WinLogon
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2372
                                                                                                                  • C:\Windows\SysWOW64\fiwmyc.exe
                                                                                                                    C:\Windows\system32\fiwmyc.exe
                                                                                                                    57⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Modifies WinLogon
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1812
                                                                                                                    • C:\Windows\SysWOW64\qwkydk.exe
                                                                                                                      C:\Windows\system32\qwkydk.exe
                                                                                                                      58⤵
                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                      • Modifies WinLogon
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:680
                                                                                                                      • C:\Windows\SysWOW64\orlauf.exe
                                                                                                                        C:\Windows\system32\orlauf.exe
                                                                                                                        59⤵
                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                        • Modifies WinLogon
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2508
                                                                                                                        • C:\Windows\SysWOW64\zdwfxa.exe
                                                                                                                          C:\Windows\system32\zdwfxa.exe
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2096
                                                                                                                          • C:\Windows\SysWOW64\yhdycj.exe
                                                                                                                            C:\Windows\system32\yhdycj.exe
                                                                                                                            61⤵
                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                            • Modifies WinLogon
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:744
                                                                                                                            • C:\Windows\SysWOW64\rjqasz.exe
                                                                                                                              C:\Windows\system32\rjqasz.exe
                                                                                                                              62⤵
                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Modifies WinLogon
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1600
                                                                                                                              • C:\Windows\SysWOW64\vjkguf.exe
                                                                                                                                C:\Windows\system32\vjkguf.exe
                                                                                                                                63⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2700
                                                                                                                                • C:\Windows\SysWOW64\vbqksv.exe
                                                                                                                                  C:\Windows\system32\vbqksv.exe
                                                                                                                                  64⤵
                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                  • Modifies WinLogon
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1260
                                                                                                                                  • C:\Windows\SysWOW64\gclprf.exe
                                                                                                                                    C:\Windows\system32\gclprf.exe
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                    • Modifies WinLogon
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:1188
                                                                                                                                    • C:\Windows\SysWOW64\jlzmtk.exe
                                                                                                                                      C:\Windows\system32\jlzmtk.exe
                                                                                                                                      66⤵
                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                      • Modifies WinLogon
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:2148
                                                                                                                                      • C:\Windows\SysWOW64\khbjch.exe
                                                                                                                                        C:\Windows\system32\khbjch.exe
                                                                                                                                        67⤵
                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:3060
                                                                                                                                        • C:\Windows\SysWOW64\flajtw.exe
                                                                                                                                          C:\Windows\system32\flajtw.exe
                                                                                                                                          68⤵
                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                          • Modifies WinLogon
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:676
                                                                                                                                          • C:\Windows\SysWOW64\mtehez.exe
                                                                                                                                            C:\Windows\system32\mtehez.exe
                                                                                                                                            69⤵
                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                            • Modifies WinLogon
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:1944
                                                                                                                                            • C:\Windows\SysWOW64\dqacnb.exe
                                                                                                                                              C:\Windows\system32\dqacnb.exe
                                                                                                                                              70⤵
                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                              • Modifies WinLogon
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:1632
                                                                                                                                              • C:\Windows\SysWOW64\kpgbiq.exe
                                                                                                                                                C:\Windows\system32\kpgbiq.exe
                                                                                                                                                71⤵
                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                                • Modifies WinLogon
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:2220
                                                                                                                                                • C:\Windows\SysWOW64\mbrchi.exe
                                                                                                                                                  C:\Windows\system32\mbrchi.exe
                                                                                                                                                  72⤵
                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                  PID:2460
                                                                                                                                                  • C:\Windows\SysWOW64\ipcclg.exe
                                                                                                                                                    C:\Windows\system32\ipcclg.exe
                                                                                                                                                    73⤵
                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                    PID:2332
                                                                                                                                                    • C:\Windows\SysWOW64\ieipmd.exe
                                                                                                                                                      C:\Windows\system32\ieipmd.exe
                                                                                                                                                      74⤵
                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      PID:1544
                                                                                                                                                      • C:\Windows\SysWOW64\udbmdb.exe
                                                                                                                                                        C:\Windows\system32\udbmdb.exe
                                                                                                                                                        75⤵
                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:1620
                                                                                                                                                        • C:\Windows\SysWOW64\rsnsvl.exe
                                                                                                                                                          C:\Windows\system32\rsnsvl.exe
                                                                                                                                                          76⤵
                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:2684
                                                                                                                                                          • C:\Windows\SysWOW64\rtqctm.exe
                                                                                                                                                            C:\Windows\system32\rtqctm.exe
                                                                                                                                                            77⤵
                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                            PID:3056
                                                                                                                                                            • C:\Windows\SysWOW64\jentvu.exe
                                                                                                                                                              C:\Windows\system32\jentvu.exe
                                                                                                                                                              78⤵
                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              PID:1036
                                                                                                                                                              • C:\Windows\SysWOW64\mpvlyl.exe
                                                                                                                                                                C:\Windows\system32\mpvlyl.exe
                                                                                                                                                                79⤵
                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                PID:2720
                                                                                                                                                                • C:\Windows\SysWOW64\ucwiod.exe
                                                                                                                                                                  C:\Windows\system32\ucwiod.exe
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                  PID:2524
                                                                                                                                                                  • C:\Windows\SysWOW64\ezvnpu.exe
                                                                                                                                                                    C:\Windows\system32\ezvnpu.exe
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                    PID:1324
                                                                                                                                                                    • C:\Windows\SysWOW64\wtydjx.exe
                                                                                                                                                                      C:\Windows\system32\wtydjx.exe
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      PID:1308
                                                                                                                                                                      • C:\Windows\SysWOW64\igqfdd.exe
                                                                                                                                                                        C:\Windows\system32\igqfdd.exe
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        PID:2968
                                                                                                                                                                        • C:\Windows\SysWOW64\dkwmgh.exe
                                                                                                                                                                          C:\Windows\system32\dkwmgh.exe
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                          PID:2280
                                                                                                                                                                          • C:\Windows\SysWOW64\qcmwxm.exe
                                                                                                                                                                            C:\Windows\system32\qcmwxm.exe
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            PID:1696
                                                                                                                                                                            • C:\Windows\SysWOW64\tcctee.exe
                                                                                                                                                                              C:\Windows\system32\tcctee.exe
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                              PID:684
                                                                                                                                                                              • C:\Windows\SysWOW64\nyakiq.exe
                                                                                                                                                                                C:\Windows\system32\nyakiq.exe
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                PID:572
                                                                                                                                                                                • C:\Windows\SysWOW64\tikuvf.exe
                                                                                                                                                                                  C:\Windows\system32\tikuvf.exe
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                  PID:1392
                                                                                                                                                                                  • C:\Windows\SysWOW64\qxohap.exe
                                                                                                                                                                                    C:\Windows\system32\qxohap.exe
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                    PID:2136
                                                                                                                                                                                    • C:\Windows\SysWOW64\rmbcdf.exe
                                                                                                                                                                                      C:\Windows\system32\rmbcdf.exe
                                                                                                                                                                                      90⤵
                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      PID:2356
                                                                                                                                                                                      • C:\Windows\SysWOW64\bwebpt.exe
                                                                                                                                                                                        C:\Windows\system32\bwebpt.exe
                                                                                                                                                                                        91⤵
                                                                                                                                                                                          PID:2244
                                                                                                                                                                                          • C:\Windows\SysWOW64\nfqivu.exe
                                                                                                                                                                                            C:\Windows\system32\nfqivu.exe
                                                                                                                                                                                            92⤵
                                                                                                                                                                                              PID:1612
                                                                                                                                                                                              • C:\Windows\SysWOW64\btvcib.exe
                                                                                                                                                                                                C:\Windows\system32\btvcib.exe
                                                                                                                                                                                                93⤵
                                                                                                                                                                                                  PID:292
                                                                                                                                                                                                  • C:\Windows\SysWOW64\rhrgta.exe
                                                                                                                                                                                                    C:\Windows\system32\rhrgta.exe
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                      PID:1928
                                                                                                                                                                                                      • C:\Windows\SysWOW64\jjqfdy.exe
                                                                                                                                                                                                        C:\Windows\system32\jjqfdy.exe
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                          • C:\Windows\SysWOW64\qgfpzx.exe
                                                                                                                                                                                                            C:\Windows\system32\qgfpzx.exe
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                              • C:\Windows\SysWOW64\iigrth.exe
                                                                                                                                                                                                                C:\Windows\system32\iigrth.exe
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\tdgljg.exe
                                                                                                                                                                                                                    C:\Windows\system32\tdgljg.exe
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                      PID:2604
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\zglivj.exe
                                                                                                                                                                                                                        C:\Windows\system32\zglivj.exe
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                          PID:2764
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\iukkcj.exe
                                                                                                                                                                                                                            C:\Windows\system32\iukkcj.exe
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                              PID:2404
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\umgqpe.exe
                                                                                                                                                                                                                                C:\Windows\system32\umgqpe.exe
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wycced.exe
                                                                                                                                                                                                                                    C:\Windows\system32\wycced.exe
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:2544
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\eeuhja.exe
                                                                                                                                                                                                                                        C:\Windows\system32\eeuhja.exe
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\eyblel.exe
                                                                                                                                                                                                                                            C:\Windows\system32\eyblel.exe
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                              PID:2124
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\gennsb.exe
                                                                                                                                                                                                                                                C:\Windows\system32\gennsb.exe
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                  PID:2028
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\oupmga.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\oupmga.exe
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\zdrvru.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\zdrvru.exe
                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                          PID:2972
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gjgxuv.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\gjgxuv.exe
                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                              PID:2888
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sfqqxl.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\sfqqxl.exe
                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\eedhbg.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\eedhbg.exe
                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                      PID:2780
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\jxvnin.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\jxvnin.exe
                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                          PID:1912
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gycddi.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\gycddi.exe
                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                              PID:988
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vqakxm.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\vqakxm.exe
                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\eejpbp.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\eejpbp.exe
                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                      PID:1000
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\bpzurt.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\bpzurt.exe
                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\whcugc.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\whcugc.exe
                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\oocvqs.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\oocvqs.exe
                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\oteifl.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\oteifl.exe
                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\xvcqfm.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\xvcqfm.exe
                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\aczojn.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\aczojn.exe
                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\swawqw.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\swawqw.exe
                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                  PID:680
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sgvalx.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\sgvalx.exe
                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\gvfugx.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\gvfugx.exe
                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                          PID:2192
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bwnasq.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\bwnasq.exe
                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                              PID:612
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cwpeku.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cwpeku.exe
                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\bkcrjp.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\bkcrjp.exe
                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                      PID:2576
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\guiujr.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\guiujr.exe
                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\qvrykt.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\qvrykt.exe
                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                              PID:1560
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ubkunr.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ubkunr.exe
                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                  PID:332
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cgsohs.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cgsohs.exe
                                                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2204
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\apfmxa.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\apfmxa.exe
                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hdiirz.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hdiirz.exe
                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\yukylk.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\yukylk.exe
                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1524
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\axmwxv.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\axmwxv.exe
                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mwguvt.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\mwguvt.exe
                                                                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2332
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ynvxul.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ynvxul.exe
                                                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sfzbhl.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\sfzbhl.exe
                                                                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cqghwy.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cqghwy.exe
                                                                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:996
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\bsaayh.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\bsaayh.exe
                                                                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\zfivxn.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\zfivxn.exe
                                                                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\csspxk.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\csspxk.exe
                                                                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\czmfom.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\czmfom.exe
                                                                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wzycae.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wzycae.exe
                                                                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bttpnb.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\bttpnb.exe
                                                                                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\dnqdwc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\dnqdwc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\uimsbb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\uimsbb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mxisjk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\mxisjk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\xndhoe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\xndhoe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\qsiacc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\qsiacc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\tqgyay.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\tqgyay.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lrnnva.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\lrnnva.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\pxgwfq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\pxgwfq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\yppyme.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\yppyme.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\xhdlzn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\xhdlzn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\welfvg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\welfvg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\fjgmyw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\fjgmyw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hvnwjy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hvnwjy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\xxeuun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\xxeuun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\aiqnot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\aiqnot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\kcnlwb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\kcnlwb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\iltdvp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\iltdvp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\lgaxoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\lgaxoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\qnbnlh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\qnbnlh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\lyieiw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\lyieiw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vszfuz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\vszfuz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\bmuhkk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\bmuhkk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lakuar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\lakuar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\shqokr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\shqokr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rpuukv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\rpuukv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cbkcjc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cbkcjc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\zpnuns.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\zpnuns.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\zgzawc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\zgzawc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\qrdiww.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\qrdiww.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wdcfrx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wdcfrx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\kcztfj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\kcztfj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1312

                                                                                                                                                                            Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            • C:\Windows\SysWOW64\rtjmse.exe
                                                                                                                                                                              Filesize

                                                                                                                                                                              106KB

                                                                                                                                                                              MD5

                                                                                                                                                                              09b38171b6e4739af9ce77fa0e821c36

                                                                                                                                                                              SHA1

                                                                                                                                                                              839280e6d386a8a951c5bc06bf702faf6254ce70

                                                                                                                                                                              SHA256

                                                                                                                                                                              d21b3244911db6e35dddcc6e843e1a35fc6b05e5dc3c9ee54234bb70b9439a1d

                                                                                                                                                                              SHA512

                                                                                                                                                                              a9d541134ceab67f909c91d7ce045f867ed195eb7982dcf4a7212432318bccbec1701d92d46582b79d582c179204a976eb6c5e164996bab67f9572d15108e4e0

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • C:\Windows\SysWOW64\zntkyr.exe
                                                                                                                                                                              Filesize

                                                                                                                                                                              145KB

                                                                                                                                                                              MD5

                                                                                                                                                                              71abcd053e767e8463bd377c5c2b908f

                                                                                                                                                                              SHA1

                                                                                                                                                                              407e033b5effa9e02d148cfdc1edc73230f39274

                                                                                                                                                                              SHA256

                                                                                                                                                                              77ee252b07e68dc35fc20b9c8b07b2bcce38d45912d9420239578a5e04131b8f

                                                                                                                                                                              SHA512

                                                                                                                                                                              68e736496edcd412831eb7c3c526f2bc6eca14f007837d3ae15d187f312ee72afa3dddba33958d310c88ee07320f56035b07d82df2d580a28bdcb4f323158a1e

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • memory/280-210-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/324-148-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/620-215-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/680-397-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/744-431-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/780-272-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/864-14-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/864-45-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1068-212-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1156-373-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1188-430-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1248-188-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1260-410-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1276-58-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-34-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-0-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-342-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-1-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1340-192-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1468-332-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1476-149-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1560-354-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1612-240-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1628-198-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1688-133-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1692-237-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1708-348-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1716-91-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1812-391-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1848-203-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1916-285-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1976-220-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1984-311-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2016-143-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2020-326-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2096-418-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2136-7-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2136-41-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2140-316-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2148-443-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2200-145-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2300-184-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2320-379-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2344-265-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2372-385-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2400-226-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2436-294-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2508-411-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2516-230-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2528-63-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2528-97-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2552-251-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2592-280-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2624-57-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2676-48-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2736-255-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2744-54-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2772-98-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2820-227-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2824-246-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2856-29-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2880-293-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2892-119-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2960-277-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2964-314-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2984-111-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2988-221-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/3016-367-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/3032-360-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            We care about your privacy.

                                                                                                                                                                            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.