Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
4fa98a44f4c4edbf0631c8d90e9287e8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4fa98a44f4c4edbf0631c8d90e9287e8.exe
Resource
win10v2004-20231215-en
General
-
Target
4fa98a44f4c4edbf0631c8d90e9287e8.exe
-
Size
56KB
-
MD5
4fa98a44f4c4edbf0631c8d90e9287e8
-
SHA1
cfa0833c274e01b097c4a4a0e644daa96d761164
-
SHA256
862720660bdab28c9473c00a3c064f6ad0b4124dc8d02064422cf970281f13e2
-
SHA512
a4bf469a330d3486f0d808c7ddd9af6ea2c23c585b8a3030d58b03f1ee481c5cb6863bd32db7fb72cfe03db1af797d3e0b3a4239d37efa209bd4df7d65cc51fc
-
SSDEEP
768:uEaz5G7MaEtbwQpeyjaSLyfOPT4xcsrRA9Xu/IC4X3i2AH350azknSRXJuRWQlhL:v4GYUWeypTUuuQj635cSRU3iN/ntN6
Malware Config
Signatures
-
Drops startup file 45 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk 4fa98a44f4c4edbf0631c8d90e9287e8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe -
Executes dropped EXE 45 IoCs
pid Process 1088 dwdsrngt.exe 1128 dwdsrngt.exe 552 dwdsrngt.exe 4208 dwdsrngt.exe 3940 dwdsrngt.exe 1492 dwdsrngt.exe 2932 dwdsrngt.exe 3908 dwdsrngt.exe 1948 dwdsrngt.exe 2684 dwdsrngt.exe 4156 dwdsrngt.exe 820 dwdsrngt.exe 4464 dwdsrngt.exe 684 dwdsrngt.exe 4588 dwdsrngt.exe 928 dwdsrngt.exe 1044 dwdsrngt.exe 2904 dwdsrngt.exe 4188 dwdsrngt.exe 4088 dwdsrngt.exe 1224 dwdsrngt.exe 2816 dwdsrngt.exe 3172 dwdsrngt.exe 2024 dwdsrngt.exe 2916 dwdsrngt.exe 1948 dwdsrngt.exe 2148 dwdsrngt.exe 1772 dwdsrngt.exe 3636 dwdsrngt.exe 1244 dwdsrngt.exe 1680 dwdsrngt.exe 4780 dwdsrngt.exe 1012 dwdsrngt.exe 4856 dwdsrngt.exe 3080 dwdsrngt.exe 4228 dwdsrngt.exe 4308 dwdsrngt.exe 4836 dwdsrngt.exe 1044 dwdsrngt.exe 2904 dwdsrngt.exe 408 dwdsrngt.exe 1300 dwdsrngt.exe 4500 dwdsrngt.exe 3636 dwdsrngt.exe 852 dwdsrngt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{CF-F3-3D-D7-ZN} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4fa98a44f4c4edbf0631c8d90e9287e8.exe CHD001" 4fa98a44f4c4edbf0631c8d90e9287e8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{CF-F3-3D-D7-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHD001" dwdsrngt.exe -
Drops file in System32 directory 48 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File created C:\Windows\SysWOW64\msnav32.ax 4fa98a44f4c4edbf0631c8d90e9287e8.exe File created \??\c:\windows\SysWOW64\dwdsrngt.exe 4fa98a44f4c4edbf0631c8d90e9287e8.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification \??\c:\windows\SysWOW64\dwdsrngt.exe 4fa98a44f4c4edbf0631c8d90e9287e8.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log 4fa98a44f4c4edbf0631c8d90e9287e8.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm 4fa98a44f4c4edbf0631c8d90e9287e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4080 4fa98a44f4c4edbf0631c8d90e9287e8.exe 4080 4fa98a44f4c4edbf0631c8d90e9287e8.exe 1088 dwdsrngt.exe 1088 dwdsrngt.exe 1128 dwdsrngt.exe 1128 dwdsrngt.exe 552 dwdsrngt.exe 552 dwdsrngt.exe 4208 dwdsrngt.exe 4208 dwdsrngt.exe 3940 dwdsrngt.exe 3940 dwdsrngt.exe 1492 dwdsrngt.exe 1492 dwdsrngt.exe 2932 dwdsrngt.exe 2932 dwdsrngt.exe 3908 dwdsrngt.exe 3908 dwdsrngt.exe 1948 dwdsrngt.exe 1948 dwdsrngt.exe 2684 dwdsrngt.exe 2684 dwdsrngt.exe 4156 dwdsrngt.exe 4156 dwdsrngt.exe 820 dwdsrngt.exe 820 dwdsrngt.exe 4464 dwdsrngt.exe 4464 dwdsrngt.exe 684 dwdsrngt.exe 684 dwdsrngt.exe 4588 dwdsrngt.exe 4588 dwdsrngt.exe 928 dwdsrngt.exe 928 dwdsrngt.exe 1044 dwdsrngt.exe 1044 dwdsrngt.exe 2904 dwdsrngt.exe 2904 dwdsrngt.exe 4188 dwdsrngt.exe 4188 dwdsrngt.exe 4088 dwdsrngt.exe 4088 dwdsrngt.exe 1224 dwdsrngt.exe 1224 dwdsrngt.exe 2816 dwdsrngt.exe 2816 dwdsrngt.exe 3172 dwdsrngt.exe 3172 dwdsrngt.exe 2024 dwdsrngt.exe 2024 dwdsrngt.exe 2916 dwdsrngt.exe 2916 dwdsrngt.exe 1948 dwdsrngt.exe 1948 dwdsrngt.exe 2148 dwdsrngt.exe 2148 dwdsrngt.exe 1772 dwdsrngt.exe 1772 dwdsrngt.exe 3636 dwdsrngt.exe 3636 dwdsrngt.exe 1244 dwdsrngt.exe 1244 dwdsrngt.exe 1680 dwdsrngt.exe 1680 dwdsrngt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 1088 4080 4fa98a44f4c4edbf0631c8d90e9287e8.exe 90 PID 4080 wrote to memory of 1088 4080 4fa98a44f4c4edbf0631c8d90e9287e8.exe 90 PID 4080 wrote to memory of 1088 4080 4fa98a44f4c4edbf0631c8d90e9287e8.exe 90 PID 1088 wrote to memory of 1128 1088 dwdsrngt.exe 91 PID 1088 wrote to memory of 1128 1088 dwdsrngt.exe 91 PID 1088 wrote to memory of 1128 1088 dwdsrngt.exe 91 PID 1128 wrote to memory of 552 1128 dwdsrngt.exe 92 PID 1128 wrote to memory of 552 1128 dwdsrngt.exe 92 PID 1128 wrote to memory of 552 1128 dwdsrngt.exe 92 PID 552 wrote to memory of 4208 552 dwdsrngt.exe 93 PID 552 wrote to memory of 4208 552 dwdsrngt.exe 93 PID 552 wrote to memory of 4208 552 dwdsrngt.exe 93 PID 4208 wrote to memory of 3940 4208 dwdsrngt.exe 94 PID 4208 wrote to memory of 3940 4208 dwdsrngt.exe 94 PID 4208 wrote to memory of 3940 4208 dwdsrngt.exe 94 PID 3940 wrote to memory of 1492 3940 dwdsrngt.exe 95 PID 3940 wrote to memory of 1492 3940 dwdsrngt.exe 95 PID 3940 wrote to memory of 1492 3940 dwdsrngt.exe 95 PID 1492 wrote to memory of 2932 1492 dwdsrngt.exe 96 PID 1492 wrote to memory of 2932 1492 dwdsrngt.exe 96 PID 1492 wrote to memory of 2932 1492 dwdsrngt.exe 96 PID 2932 wrote to memory of 3908 2932 dwdsrngt.exe 98 PID 2932 wrote to memory of 3908 2932 dwdsrngt.exe 98 PID 2932 wrote to memory of 3908 2932 dwdsrngt.exe 98 PID 3908 wrote to memory of 1948 3908 dwdsrngt.exe 123 PID 3908 wrote to memory of 1948 3908 dwdsrngt.exe 123 PID 3908 wrote to memory of 1948 3908 dwdsrngt.exe 123 PID 1948 wrote to memory of 2684 1948 dwdsrngt.exe 103 PID 1948 wrote to memory of 2684 1948 dwdsrngt.exe 103 PID 1948 wrote to memory of 2684 1948 dwdsrngt.exe 103 PID 2684 wrote to memory of 4156 2684 dwdsrngt.exe 104 PID 2684 wrote to memory of 4156 2684 dwdsrngt.exe 104 PID 2684 wrote to memory of 4156 2684 dwdsrngt.exe 104 PID 4156 wrote to memory of 820 4156 dwdsrngt.exe 107 PID 4156 wrote to memory of 820 4156 dwdsrngt.exe 107 PID 4156 wrote to memory of 820 4156 dwdsrngt.exe 107 PID 820 wrote to memory of 4464 820 dwdsrngt.exe 108 PID 820 wrote to memory of 4464 820 dwdsrngt.exe 108 PID 820 wrote to memory of 4464 820 dwdsrngt.exe 108 PID 4464 wrote to memory of 684 4464 dwdsrngt.exe 109 PID 4464 wrote to memory of 684 4464 dwdsrngt.exe 109 PID 4464 wrote to memory of 684 4464 dwdsrngt.exe 109 PID 684 wrote to memory of 4588 684 dwdsrngt.exe 112 PID 684 wrote to memory of 4588 684 dwdsrngt.exe 112 PID 684 wrote to memory of 4588 684 dwdsrngt.exe 112 PID 4588 wrote to memory of 928 4588 dwdsrngt.exe 113 PID 4588 wrote to memory of 928 4588 dwdsrngt.exe 113 PID 4588 wrote to memory of 928 4588 dwdsrngt.exe 113 PID 928 wrote to memory of 1044 928 dwdsrngt.exe 114 PID 928 wrote to memory of 1044 928 dwdsrngt.exe 114 PID 928 wrote to memory of 1044 928 dwdsrngt.exe 114 PID 1044 wrote to memory of 2904 1044 dwdsrngt.exe 115 PID 1044 wrote to memory of 2904 1044 dwdsrngt.exe 115 PID 1044 wrote to memory of 2904 1044 dwdsrngt.exe 115 PID 2904 wrote to memory of 4188 2904 dwdsrngt.exe 116 PID 2904 wrote to memory of 4188 2904 dwdsrngt.exe 116 PID 2904 wrote to memory of 4188 2904 dwdsrngt.exe 116 PID 4188 wrote to memory of 4088 4188 dwdsrngt.exe 117 PID 4188 wrote to memory of 4088 4188 dwdsrngt.exe 117 PID 4188 wrote to memory of 4088 4188 dwdsrngt.exe 117 PID 4088 wrote to memory of 1224 4088 dwdsrngt.exe 118 PID 4088 wrote to memory of 1224 4088 dwdsrngt.exe 118 PID 4088 wrote to memory of 1224 4088 dwdsrngt.exe 118 PID 1224 wrote to memory of 2816 1224 dwdsrngt.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fa98a44f4c4edbf0631c8d90e9287e8.exe"C:\Users\Admin\AppData\Local\Temp\4fa98a44f4c4edbf0631c8d90e9287e8.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0012⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0013⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0014⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0015⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0016⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0017⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0018⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0019⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00110⤵PID:1948
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00111⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00112⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00113⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00114⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00115⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00116⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00117⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00118⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00119⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00120⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00121⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00122⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00123⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2816 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00124⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3172 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00125⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2024 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00126⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2916 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00127⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00128⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2148 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00129⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1772 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00130⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3636 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00131⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1244 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00132⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1680 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00133⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4780 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00134⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1012 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00135⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4856 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00136⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3080 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00137⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4228 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00138⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4308 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00139⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4836 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00140⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1044 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00141⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2904 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00142⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:408 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00143⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1300 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00144⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4500 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00145⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3636 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00146⤵PID:852
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00147⤵PID:4836
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00148⤵PID:1044
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00149⤵PID:4428
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00150⤵PID:3940
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00151⤵PID:4028
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00152⤵PID:4836
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00153⤵PID:1280
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00154⤵PID:4456
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00155⤵PID:376
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00156⤵PID:1200
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00157⤵PID:3348
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00158⤵PID:840
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00159⤵PID:4324
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00160⤵PID:1332
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00161⤵PID:4484
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00162⤵PID:4736
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00163⤵PID:3268
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00164⤵PID:100
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00165⤵PID:4136
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00166⤵PID:4056
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00167⤵PID:5092
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00168⤵PID:2904
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00169⤵PID:4900
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00170⤵PID:752
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00171⤵PID:1336
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00172⤵PID:4352
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00173⤵PID:2040
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00174⤵PID:4380
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00175⤵PID:3216
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00176⤵PID:1684
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00177⤵PID:956
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00178⤵PID:3244
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00179⤵PID:4080
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00180⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:852 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00181⤵PID:3776
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00182⤵PID:4464
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00183⤵PID:3936
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00184⤵PID:2180
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00185⤵PID:2648
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00186⤵PID:2500
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00187⤵PID:1404
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00188⤵PID:4772
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00189⤵PID:1336
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00190⤵PID:376
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00191⤵PID:224
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00192⤵PID:1620
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00193⤵PID:3348
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00194⤵PID:1568
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00195⤵PID:3664
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00196⤵PID:2492
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00197⤵PID:3280
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00198⤵PID:1240
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00199⤵PID:1332
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001100⤵PID:4484
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001101⤵PID:3444
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001102⤵PID:1380
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001103⤵PID:3776
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001104⤵PID:3800
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001105⤵PID:4560
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001106⤵PID:4260
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001107⤵PID:4056
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001108⤵PID:1468
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001109⤵PID:2588
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001110⤵PID:5072
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001111⤵PID:4772
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001112⤵PID:4668
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001113⤵PID:904
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001114⤵PID:1532
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001115⤵PID:4380
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001116⤵PID:4904
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001117⤵PID:920
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001118⤵PID:3664
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001119⤵PID:4988
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001120⤵PID:748
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001121⤵PID:4888
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001122⤵PID:4088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-