Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

71abcd053e...8f.exe

windows7-x64

10

71abcd053e...8f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 13:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    71abcd053e767e8463bd377c5c2b908f.exe

  • Size

    145KB

  • MD5

    71abcd053e767e8463bd377c5c2b908f

  • SHA1

    407e033b5effa9e02d148cfdc1edc73230f39274

  • SHA256

    77ee252b07e68dc35fc20b9c8b07b2bcce38d45912d9420239578a5e04131b8f

  • SHA512

    68e736496edcd412831eb7c3c526f2bc6eca14f007837d3ae15d187f312ee72afa3dddba33958d310c88ee07320f56035b07d82df2d580a28bdcb4f323158a1e

  • SSDEEP

    3072:/juq3BQoNypn9hvkwXtvmZ6Q4YxmiPkCaepM9GPw:/jdz0n9hvkwXtvmxmwXK94w

Score
10/10
persistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Modifies WinLogon 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71abcd053e767e8463bd377c5c2b908f.exe
    "C:\Users\Admin\AppData\Local\Temp\71abcd053e767e8463bd377c5c2b908f.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\SysWOW64\wyomuh.exe
      C:\Windows\system32\wyomuh.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Windows\SysWOW64\abkvku.exe
        C:\Windows\system32\abkvku.exe
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks for any installed AV software in registry
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\SysWOW64\exnltq.exe
          C:\Windows\system32\exnltq.exe
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks for any installed AV software in registry
          • Modifies WinLogon
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Windows\SysWOW64\bnqlwu.exe
            C:\Windows\system32\bnqlwu.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks for any installed AV software in registry
            • Modifies WinLogon
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2856
            • C:\Windows\SysWOW64\rmmlht.exe
              C:\Windows\system32\rmmlht.exe
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies WinLogon
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2744
              • C:\Windows\SysWOW64\pbnqww.exe
                C:\Windows\system32\pbnqww.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks for any installed AV software in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1276
                • C:\Windows\SysWOW64\zntkyr.exe
                  C:\Windows\system32\zntkyr.exe
                  8⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks for any installed AV software in registry
                  • Modifies WinLogon
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2624
                  • C:\Windows\SysWOW64\nqgejp.exe
                    C:\Windows\system32\nqgejp.exe
                    9⤵
                    • Modifies WinLogon for persistence
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks for any installed AV software in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2528
                    • C:\Windows\SysWOW64\lqkwuk.exe
                      C:\Windows\system32\lqkwuk.exe
                      10⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2984
                      • C:\Windows\SysWOW64\xqmehw.exe
                        C:\Windows\system32\xqmehw.exe
                        11⤵
                        • Modifies WinLogon for persistence
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2892
                        • C:\Windows\SysWOW64\xpsqov.exe
                          C:\Windows\system32\xpsqov.exe
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks for any installed AV software in registry
                          • Modifies WinLogon
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1716
                          • C:\Windows\SysWOW64\rtjmse.exe
                            C:\Windows\system32\rtjmse.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks for any installed AV software in registry
                            • Modifies WinLogon
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2772
                            • C:\Windows\SysWOW64\fczyxf.exe
                              C:\Windows\system32\fczyxf.exe
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks for any installed AV software in registry
                              • Modifies WinLogon
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2016
                              • C:\Windows\SysWOW64\nklnkq.exe
                                C:\Windows\system32\nklnkq.exe
                                15⤵
                                • Modifies WinLogon for persistence
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies WinLogon
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:324
                                • C:\Windows\SysWOW64\tbwjod.exe
                                  C:\Windows\system32\tbwjod.exe
                                  16⤵
                                  • Modifies WinLogon for persistence
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks for any installed AV software in registry
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:1476
                                  • C:\Windows\SysWOW64\qgiqki.exe
                                    C:\Windows\system32\qgiqki.exe
                                    17⤵
                                    • Modifies WinLogon for persistence
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks for any installed AV software in registry
                                    • Modifies WinLogon
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1688
                                    • C:\Windows\SysWOW64\soeeyk.exe
                                      C:\Windows\system32\soeeyk.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks for any installed AV software in registry
                                      • Modifies WinLogon
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2200
                                      • C:\Windows\SysWOW64\ynsewa.exe
                                        C:\Windows\system32\ynsewa.exe
                                        19⤵
                                        • Modifies WinLogon for persistence
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks for any installed AV software in registry
                                        • Modifies WinLogon
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2300
                                        • C:\Windows\SysWOW64\pjlgkp.exe
                                          C:\Windows\system32\pjlgkp.exe
                                          20⤵
                                          • Modifies WinLogon for persistence
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Modifies WinLogon
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1248
                                          • C:\Windows\SysWOW64\yzxpjg.exe
                                            C:\Windows\system32\yzxpjg.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Checks for any installed AV software in registry
                                            • Drops file in System32 directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1340
                                            • C:\Windows\SysWOW64\bcezdp.exe
                                              C:\Windows\system32\bcezdp.exe
                                              22⤵
                                              • Modifies WinLogon for persistence
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Checks for any installed AV software in registry
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1628
                                              • C:\Windows\SysWOW64\atfqxq.exe
                                                C:\Windows\system32\atfqxq.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Checks for any installed AV software in registry
                                                • Modifies WinLogon
                                                • Drops file in System32 directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1848
                                                • C:\Windows\SysWOW64\sdvnha.exe
                                                  C:\Windows\system32\sdvnha.exe
                                                  24⤵
                                                  • Modifies WinLogon for persistence
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Checks for any installed AV software in registry
                                                  • Modifies WinLogon
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1068
                                                  • C:\Windows\SysWOW64\rsadyr.exe
                                                    C:\Windows\system32\rsadyr.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Checks for any installed AV software in registry
                                                    • Modifies WinLogon
                                                    • Drops file in System32 directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:620
                                                    • C:\Windows\SysWOW64\alttwn.exe
                                                      C:\Windows\system32\alttwn.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Checks for any installed AV software in registry
                                                      • Modifies WinLogon
                                                      • Drops file in System32 directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1976
                                                      • C:\Windows\SysWOW64\hrubkg.exe
                                                        C:\Windows\system32\hrubkg.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks for any installed AV software in registry
                                                        • Modifies WinLogon
                                                        • Drops file in System32 directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2400
                                                        • C:\Windows\SysWOW64\emcdai.exe
                                                          C:\Windows\system32\emcdai.exe
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2516
                                                          • C:\Windows\SysWOW64\najtqy.exe
                                                            C:\Windows\system32\najtqy.exe
                                                            29⤵
                                                            • Modifies WinLogon for persistence
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks for any installed AV software in registry
                                                            • Modifies WinLogon
                                                            • Drops file in System32 directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:280
                                                            • C:\Windows\SysWOW64\glrzxv.exe
                                                              C:\Windows\system32\glrzxv.exe
                                                              30⤵
                                                              • Modifies WinLogon for persistence
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks for any installed AV software in registry
                                                              • Modifies WinLogon
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1612
                                                              • C:\Windows\SysWOW64\qhkumx.exe
                                                                C:\Windows\system32\qhkumx.exe
                                                                31⤵
                                                                • Modifies WinLogon for persistence
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in System32 directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2988
                                                                • C:\Windows\SysWOW64\jhvsrj.exe
                                                                  C:\Windows\system32\jhvsrj.exe
                                                                  32⤵
                                                                  • Modifies WinLogon for persistence
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Checks for any installed AV software in registry
                                                                  • Modifies WinLogon
                                                                  • Drops file in System32 directory
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2820
                                                                  • C:\Windows\SysWOW64\qzuzfg.exe
                                                                    C:\Windows\system32\qzuzfg.exe
                                                                    33⤵
                                                                    • Modifies WinLogon for persistence
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Checks for any installed AV software in registry
                                                                    • Modifies WinLogon
                                                                    • Drops file in System32 directory
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2736
                                                                    • C:\Windows\SysWOW64\ehnglz.exe
                                                                      C:\Windows\system32\ehnglz.exe
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Modifies WinLogon
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1692
                                                                      • C:\Windows\SysWOW64\moiflh.exe
                                                                        C:\Windows\system32\moiflh.exe
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks for any installed AV software in registry
                                                                        • Modifies WinLogon
                                                                        • Drops file in System32 directory
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2344
                                                                        • C:\Windows\SysWOW64\xqgozk.exe
                                                                          C:\Windows\system32\xqgozk.exe
                                                                          36⤵
                                                                          • Modifies WinLogon for persistence
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks for any installed AV software in registry
                                                                          • Modifies WinLogon
                                                                          • Drops file in System32 directory
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2824
                                                                          • C:\Windows\SysWOW64\yakiuy.exe
                                                                            C:\Windows\system32\yakiuy.exe
                                                                            37⤵
                                                                            • Modifies WinLogon for persistence
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Checks for any installed AV software in registry
                                                                            • Modifies WinLogon
                                                                            • Drops file in System32 directory
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2552
                                                                            • C:\Windows\SysWOW64\yzisan.exe
                                                                              C:\Windows\system32\yzisan.exe
                                                                              38⤵
                                                                              • Modifies WinLogon for persistence
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Checks for any installed AV software in registry
                                                                              • Modifies WinLogon
                                                                              • Drops file in System32 directory
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2592
                                                                              • C:\Windows\SysWOW64\zmfhks.exe
                                                                                C:\Windows\system32\zmfhks.exe
                                                                                39⤵
                                                                                • Modifies WinLogon for persistence
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Checks for any installed AV software in registry
                                                                                • Modifies WinLogon
                                                                                • Drops file in System32 directory
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1916
                                                                                • C:\Windows\SysWOW64\wmjkdy.exe
                                                                                  C:\Windows\system32\wmjkdy.exe
                                                                                  40⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2436
                                                                                  • C:\Windows\SysWOW64\ifclwg.exe
                                                                                    C:\Windows\system32\ifclwg.exe
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Checks for any installed AV software in registry
                                                                                    • Modifies WinLogon
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:780
                                                                                    • C:\Windows\SysWOW64\qcgcan.exe
                                                                                      C:\Windows\system32\qcgcan.exe
                                                                                      42⤵
                                                                                      • Modifies WinLogon for persistence
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Checks for any installed AV software in registry
                                                                                      • Modifies WinLogon
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2960
                                                                                      • C:\Windows\SysWOW64\nlaflz.exe
                                                                                        C:\Windows\system32\nlaflz.exe
                                                                                        43⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Modifies WinLogon
                                                                                        • Drops file in System32 directory
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2964
                                                                                        • C:\Windows\SysWOW64\akogfo.exe
                                                                                          C:\Windows\system32\akogfo.exe
                                                                                          44⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks for any installed AV software in registry
                                                                                          • Modifies WinLogon
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2140
                                                                                          • C:\Windows\SysWOW64\ajnnlt.exe
                                                                                            C:\Windows\system32\ajnnlt.exe
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Checks for any installed AV software in registry
                                                                                            • Modifies WinLogon
                                                                                            • Drops file in System32 directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2880
                                                                                            • C:\Windows\SysWOW64\moojmz.exe
                                                                                              C:\Windows\system32\moojmz.exe
                                                                                              46⤵
                                                                                              • Modifies WinLogon for persistence
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Checks for any installed AV software in registry
                                                                                              • Modifies WinLogon
                                                                                              • Drops file in System32 directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2020
                                                                                              • C:\Windows\SysWOW64\gcsgds.exe
                                                                                                C:\Windows\system32\gcsgds.exe
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks for any installed AV software in registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1468
                                                                                                • C:\Windows\SysWOW64\mwzsdb.exe
                                                                                                  C:\Windows\system32\mwzsdb.exe
                                                                                                  48⤵
                                                                                                  • Modifies WinLogon for persistence
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Checks for any installed AV software in registry
                                                                                                  • Modifies WinLogon
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1984
                                                                                                  • C:\Windows\SysWOW64\kbeltb.exe
                                                                                                    C:\Windows\system32\kbeltb.exe
                                                                                                    49⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1304
                                                                                                    • C:\Windows\SysWOW64\iybhfi.exe
                                                                                                      C:\Windows\system32\iybhfi.exe
                                                                                                      50⤵
                                                                                                      • Modifies WinLogon for persistence
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Checks for any installed AV software in registry
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1708
                                                                                                      • C:\Windows\SysWOW64\uihjnq.exe
                                                                                                        C:\Windows\system32\uihjnq.exe
                                                                                                        51⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Checks for any installed AV software in registry
                                                                                                        • Modifies WinLogon
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1560
                                                                                                        • C:\Windows\SysWOW64\weuokn.exe
                                                                                                          C:\Windows\system32\weuokn.exe
                                                                                                          52⤵
                                                                                                          • Modifies WinLogon for persistence
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Checks for any installed AV software in registry
                                                                                                          • Modifies WinLogon
                                                                                                          • Drops file in System32 directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3032
                                                                                                          • C:\Windows\SysWOW64\ssuydi.exe
                                                                                                            C:\Windows\system32\ssuydi.exe
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks for any installed AV software in registry
                                                                                                            • Modifies WinLogon
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3016
                                                                                                            • C:\Windows\SysWOW64\qaiafp.exe
                                                                                                              C:\Windows\system32\qaiafp.exe
                                                                                                              54⤵
                                                                                                              • Modifies WinLogon for persistence
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • Checks for any installed AV software in registry
                                                                                                              • Modifies WinLogon
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:1156
                                                                                                              • C:\Windows\SysWOW64\turrnr.exe
                                                                                                                C:\Windows\system32\turrnr.exe
                                                                                                                55⤵
                                                                                                                • Modifies WinLogon for persistence
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • Checks for any installed AV software in registry
                                                                                                                • Modifies WinLogon
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2320
                                                                                                                • C:\Windows\SysWOW64\deouyw.exe
                                                                                                                  C:\Windows\system32\deouyw.exe
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                  • Modifies WinLogon
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2372
                                                                                                                  • C:\Windows\SysWOW64\fiwmyc.exe
                                                                                                                    C:\Windows\system32\fiwmyc.exe
                                                                                                                    57⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Modifies WinLogon
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1812
                                                                                                                    • C:\Windows\SysWOW64\qwkydk.exe
                                                                                                                      C:\Windows\system32\qwkydk.exe
                                                                                                                      58⤵
                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                      • Modifies WinLogon
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:680
                                                                                                                      • C:\Windows\SysWOW64\orlauf.exe
                                                                                                                        C:\Windows\system32\orlauf.exe
                                                                                                                        59⤵
                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                        • Modifies WinLogon
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2508
                                                                                                                        • C:\Windows\SysWOW64\zdwfxa.exe
                                                                                                                          C:\Windows\system32\zdwfxa.exe
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2096
                                                                                                                          • C:\Windows\SysWOW64\yhdycj.exe
                                                                                                                            C:\Windows\system32\yhdycj.exe
                                                                                                                            61⤵
                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                            • Modifies WinLogon
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:744
                                                                                                                            • C:\Windows\SysWOW64\rjqasz.exe
                                                                                                                              C:\Windows\system32\rjqasz.exe
                                                                                                                              62⤵
                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Modifies WinLogon
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1600
                                                                                                                              • C:\Windows\SysWOW64\vjkguf.exe
                                                                                                                                C:\Windows\system32\vjkguf.exe
                                                                                                                                63⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2700
                                                                                                                                • C:\Windows\SysWOW64\vbqksv.exe
                                                                                                                                  C:\Windows\system32\vbqksv.exe
                                                                                                                                  64⤵
                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                  • Modifies WinLogon
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1260
                                                                                                                                  • C:\Windows\SysWOW64\gclprf.exe
                                                                                                                                    C:\Windows\system32\gclprf.exe
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                    • Modifies WinLogon
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:1188
                                                                                                                                    • C:\Windows\SysWOW64\jlzmtk.exe
                                                                                                                                      C:\Windows\system32\jlzmtk.exe
                                                                                                                                      66⤵
                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                      • Modifies WinLogon
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:2148
                                                                                                                                      • C:\Windows\SysWOW64\khbjch.exe
                                                                                                                                        C:\Windows\system32\khbjch.exe
                                                                                                                                        67⤵
                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:3060
                                                                                                                                        • C:\Windows\SysWOW64\flajtw.exe
                                                                                                                                          C:\Windows\system32\flajtw.exe
                                                                                                                                          68⤵
                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                          • Modifies WinLogon
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:676
                                                                                                                                          • C:\Windows\SysWOW64\mtehez.exe
                                                                                                                                            C:\Windows\system32\mtehez.exe
                                                                                                                                            69⤵
                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                            • Modifies WinLogon
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:1944
                                                                                                                                            • C:\Windows\SysWOW64\dqacnb.exe
                                                                                                                                              C:\Windows\system32\dqacnb.exe
                                                                                                                                              70⤵
                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                              • Modifies WinLogon
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:1632
                                                                                                                                              • C:\Windows\SysWOW64\kpgbiq.exe
                                                                                                                                                C:\Windows\system32\kpgbiq.exe
                                                                                                                                                71⤵
                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                                • Modifies WinLogon
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:2220
                                                                                                                                                • C:\Windows\SysWOW64\mbrchi.exe
                                                                                                                                                  C:\Windows\system32\mbrchi.exe
                                                                                                                                                  72⤵
                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                  PID:2460
                                                                                                                                                  • C:\Windows\SysWOW64\ipcclg.exe
                                                                                                                                                    C:\Windows\system32\ipcclg.exe
                                                                                                                                                    73⤵
                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                    PID:2332
                                                                                                                                                    • C:\Windows\SysWOW64\ieipmd.exe
                                                                                                                                                      C:\Windows\system32\ieipmd.exe
                                                                                                                                                      74⤵
                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      PID:1544
                                                                                                                                                      • C:\Windows\SysWOW64\udbmdb.exe
                                                                                                                                                        C:\Windows\system32\udbmdb.exe
                                                                                                                                                        75⤵
                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:1620
                                                                                                                                                        • C:\Windows\SysWOW64\rsnsvl.exe
                                                                                                                                                          C:\Windows\system32\rsnsvl.exe
                                                                                                                                                          76⤵
                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:2684
                                                                                                                                                          • C:\Windows\SysWOW64\rtqctm.exe
                                                                                                                                                            C:\Windows\system32\rtqctm.exe
                                                                                                                                                            77⤵
                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                            PID:3056
                                                                                                                                                            • C:\Windows\SysWOW64\jentvu.exe
                                                                                                                                                              C:\Windows\system32\jentvu.exe
                                                                                                                                                              78⤵
                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              PID:1036
                                                                                                                                                              • C:\Windows\SysWOW64\mpvlyl.exe
                                                                                                                                                                C:\Windows\system32\mpvlyl.exe
                                                                                                                                                                79⤵
                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                PID:2720
                                                                                                                                                                • C:\Windows\SysWOW64\ucwiod.exe
                                                                                                                                                                  C:\Windows\system32\ucwiod.exe
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                  PID:2524
                                                                                                                                                                  • C:\Windows\SysWOW64\ezvnpu.exe
                                                                                                                                                                    C:\Windows\system32\ezvnpu.exe
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                    PID:1324
                                                                                                                                                                    • C:\Windows\SysWOW64\wtydjx.exe
                                                                                                                                                                      C:\Windows\system32\wtydjx.exe
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      PID:1308
                                                                                                                                                                      • C:\Windows\SysWOW64\igqfdd.exe
                                                                                                                                                                        C:\Windows\system32\igqfdd.exe
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        PID:2968
                                                                                                                                                                        • C:\Windows\SysWOW64\dkwmgh.exe
                                                                                                                                                                          C:\Windows\system32\dkwmgh.exe
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                          PID:2280
                                                                                                                                                                          • C:\Windows\SysWOW64\qcmwxm.exe
                                                                                                                                                                            C:\Windows\system32\qcmwxm.exe
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            PID:1696
                                                                                                                                                                            • C:\Windows\SysWOW64\tcctee.exe
                                                                                                                                                                              C:\Windows\system32\tcctee.exe
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                              PID:684
                                                                                                                                                                              • C:\Windows\SysWOW64\nyakiq.exe
                                                                                                                                                                                C:\Windows\system32\nyakiq.exe
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                PID:572
                                                                                                                                                                                • C:\Windows\SysWOW64\tikuvf.exe
                                                                                                                                                                                  C:\Windows\system32\tikuvf.exe
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                  PID:1392
                                                                                                                                                                                  • C:\Windows\SysWOW64\qxohap.exe
                                                                                                                                                                                    C:\Windows\system32\qxohap.exe
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                    PID:2136
                                                                                                                                                                                    • C:\Windows\SysWOW64\rmbcdf.exe
                                                                                                                                                                                      C:\Windows\system32\rmbcdf.exe
                                                                                                                                                                                      90⤵
                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      PID:2356
                                                                                                                                                                                      • C:\Windows\SysWOW64\bwebpt.exe
                                                                                                                                                                                        C:\Windows\system32\bwebpt.exe
                                                                                                                                                                                        91⤵
                                                                                                                                                                                          PID:2244
                                                                                                                                                                                          • C:\Windows\SysWOW64\nfqivu.exe
                                                                                                                                                                                            C:\Windows\system32\nfqivu.exe
                                                                                                                                                                                            92⤵
                                                                                                                                                                                              PID:1612
                                                                                                                                                                                              • C:\Windows\SysWOW64\btvcib.exe
                                                                                                                                                                                                C:\Windows\system32\btvcib.exe
                                                                                                                                                                                                93⤵
                                                                                                                                                                                                  PID:292
                                                                                                                                                                                                  • C:\Windows\SysWOW64\rhrgta.exe
                                                                                                                                                                                                    C:\Windows\system32\rhrgta.exe
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                      PID:1928
                                                                                                                                                                                                      • C:\Windows\SysWOW64\jjqfdy.exe
                                                                                                                                                                                                        C:\Windows\system32\jjqfdy.exe
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                          • C:\Windows\SysWOW64\qgfpzx.exe
                                                                                                                                                                                                            C:\Windows\system32\qgfpzx.exe
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                              • C:\Windows\SysWOW64\iigrth.exe
                                                                                                                                                                                                                C:\Windows\system32\iigrth.exe
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\tdgljg.exe
                                                                                                                                                                                                                    C:\Windows\system32\tdgljg.exe
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                      PID:2604
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\zglivj.exe
                                                                                                                                                                                                                        C:\Windows\system32\zglivj.exe
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                          PID:2764
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\iukkcj.exe
                                                                                                                                                                                                                            C:\Windows\system32\iukkcj.exe
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                              PID:2404
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\umgqpe.exe
                                                                                                                                                                                                                                C:\Windows\system32\umgqpe.exe
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wycced.exe
                                                                                                                                                                                                                                    C:\Windows\system32\wycced.exe
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:2544
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\eeuhja.exe
                                                                                                                                                                                                                                        C:\Windows\system32\eeuhja.exe
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\eyblel.exe
                                                                                                                                                                                                                                            C:\Windows\system32\eyblel.exe
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                              PID:2124
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\gennsb.exe
                                                                                                                                                                                                                                                C:\Windows\system32\gennsb.exe
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                  PID:2028
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\oupmga.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\oupmga.exe
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\zdrvru.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\zdrvru.exe
                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                          PID:2972
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gjgxuv.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\gjgxuv.exe
                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                              PID:2888
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sfqqxl.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\sfqqxl.exe
                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\eedhbg.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\eedhbg.exe
                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                      PID:2780
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\jxvnin.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\jxvnin.exe
                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                          PID:1912
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gycddi.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\gycddi.exe
                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                              PID:988
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vqakxm.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\vqakxm.exe
                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\eejpbp.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\eejpbp.exe
                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                      PID:1000
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\bpzurt.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\bpzurt.exe
                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\whcugc.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\whcugc.exe
                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\oocvqs.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\oocvqs.exe
                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\oteifl.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\oteifl.exe
                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\xvcqfm.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\xvcqfm.exe
                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\aczojn.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\aczojn.exe
                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\swawqw.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\swawqw.exe
                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                  PID:680
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sgvalx.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\sgvalx.exe
                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\gvfugx.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\gvfugx.exe
                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                          PID:2192
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bwnasq.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\bwnasq.exe
                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                              PID:612
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cwpeku.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cwpeku.exe
                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\bkcrjp.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\bkcrjp.exe
                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                      PID:2576
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\guiujr.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\guiujr.exe
                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\qvrykt.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\qvrykt.exe
                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                              PID:1560
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ubkunr.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ubkunr.exe
                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                  PID:332
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cgsohs.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cgsohs.exe
                                                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2204
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\apfmxa.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\apfmxa.exe
                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hdiirz.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hdiirz.exe
                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\yukylk.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\yukylk.exe
                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1524
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\axmwxv.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\axmwxv.exe
                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mwguvt.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\mwguvt.exe
                                                                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2332
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ynvxul.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ynvxul.exe
                                                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sfzbhl.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\sfzbhl.exe
                                                                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cqghwy.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cqghwy.exe
                                                                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:996
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\bsaayh.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\bsaayh.exe
                                                                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\zfivxn.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\zfivxn.exe
                                                                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\csspxk.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\csspxk.exe
                                                                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\czmfom.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\czmfom.exe
                                                                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wzycae.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wzycae.exe
                                                                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bttpnb.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\bttpnb.exe
                                                                                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\dnqdwc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\dnqdwc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\uimsbb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\uimsbb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mxisjk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\mxisjk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\xndhoe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\xndhoe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\qsiacc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\qsiacc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\tqgyay.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\tqgyay.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lrnnva.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\lrnnva.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\pxgwfq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\pxgwfq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\yppyme.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\yppyme.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\xhdlzn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\xhdlzn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\welfvg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\welfvg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\fjgmyw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\fjgmyw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hvnwjy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hvnwjy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\xxeuun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\xxeuun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\aiqnot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\aiqnot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\kcnlwb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\kcnlwb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\iltdvp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\iltdvp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\lgaxoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\lgaxoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\qnbnlh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\qnbnlh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\lyieiw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\lyieiw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vszfuz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\vszfuz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\bmuhkk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\bmuhkk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lakuar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\lakuar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\shqokr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\shqokr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rpuukv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\rpuukv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cbkcjc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cbkcjc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\zpnuns.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\zpnuns.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\zgzawc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\zgzawc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\qrdiww.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\qrdiww.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wdcfrx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wdcfrx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\kcztfj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\kcztfj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1312

                                                                                                                                                                            Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            • C:\Windows\SysWOW64\rtjmse.exe
                                                                                                                                                                              Filesize

                                                                                                                                                                              106KB

                                                                                                                                                                              MD5

                                                                                                                                                                              09b38171b6e4739af9ce77fa0e821c36

                                                                                                                                                                              SHA1

                                                                                                                                                                              839280e6d386a8a951c5bc06bf702faf6254ce70

                                                                                                                                                                              SHA256

                                                                                                                                                                              d21b3244911db6e35dddcc6e843e1a35fc6b05e5dc3c9ee54234bb70b9439a1d

                                                                                                                                                                              SHA512

                                                                                                                                                                              a9d541134ceab67f909c91d7ce045f867ed195eb7982dcf4a7212432318bccbec1701d92d46582b79d582c179204a976eb6c5e164996bab67f9572d15108e4e0

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • C:\Windows\SysWOW64\zntkyr.exe
                                                                                                                                                                              Filesize

                                                                                                                                                                              145KB

                                                                                                                                                                              MD5

                                                                                                                                                                              71abcd053e767e8463bd377c5c2b908f

                                                                                                                                                                              SHA1

                                                                                                                                                                              407e033b5effa9e02d148cfdc1edc73230f39274

                                                                                                                                                                              SHA256

                                                                                                                                                                              77ee252b07e68dc35fc20b9c8b07b2bcce38d45912d9420239578a5e04131b8f

                                                                                                                                                                              SHA512

                                                                                                                                                                              68e736496edcd412831eb7c3c526f2bc6eca14f007837d3ae15d187f312ee72afa3dddba33958d310c88ee07320f56035b07d82df2d580a28bdcb4f323158a1e

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • memory/280-210-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/324-148-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/620-215-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/680-397-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/744-431-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/780-272-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/864-14-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/864-45-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1068-212-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1156-373-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1188-430-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1248-188-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1260-410-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1276-58-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-34-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-0-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-342-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1304-1-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1340-192-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1468-332-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1476-149-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1560-354-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1612-240-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1628-198-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1688-133-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1692-237-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1708-348-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1716-91-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1812-391-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1848-203-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1916-285-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1976-220-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1984-311-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2016-143-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2020-326-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2096-418-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2136-7-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2136-41-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2140-316-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2148-443-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2200-145-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2300-184-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2320-379-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2344-265-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2372-385-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2400-226-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2436-294-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2508-411-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2516-230-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2528-63-0x0000000000230000-0x0000000000249000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2528-97-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2552-251-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2592-280-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2624-57-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2676-48-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2736-255-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2744-54-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2772-98-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2820-227-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2824-246-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2856-29-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2880-293-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2892-119-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2960-277-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2964-314-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2984-111-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/2988-221-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/3016-367-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/3032-360-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              160KB

                                                                                                                                                                              Download