Overview

overview

7

Static

static

3

VirusShare...27.exe

windows7-x64

7

VirusShare...27.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    72s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 13:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirusShare_16e64b83933c0ea42ec9de131c4d2527.exe

  • Size

    24KB

  • MD5

    16e64b83933c0ea42ec9de131c4d2527

  • SHA1

    2d608bd9a248701068c50b8d6f9ca2d4150d8261

  • SHA256

    b32781dffffaddc2ccab6f76dd0044894c2e3db8346bfc5e4e0d09624fee14c9

  • SHA512

    927403fd454f786d1f91673fd32a0812e43700065699ef139443ebe03e3a3fbb8e159f5324cbce42de5f7141ac302e38a944d85ebdf62b9825d48553b6996f87

  • SSDEEP

    192:oVAexK8tq37U5AlT0TwiyY9xGd46fA1F1/+oSGRPzR/QdmIcybcx:oVe7pSy2xGd4oQF1/rNRPzR/QD1k

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 56 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_16e64b83933c0ea42ec9de131c4d2527.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_16e64b83933c0ea42ec9de131c4d2527.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\SysWOW64\loru5a7.exe
      "C:\Windows\system32\loru5a7.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\SysWOW64\ilor47e.exe
        "C:\Windows\system32\ilor47e.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\nqtw4ee.exe
          "C:\Windows\system32\nqtw4ee.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4468
          • C:\Windows\SysWOW64\behkcfe.exe
            "C:\Windows\system32\behkcfe.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2384
            • C:\Windows\SysWOW64\dgjm676.exe
              "C:\Windows\system32\dgjm676.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3584
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm676.exe > nul
                7⤵
                  PID:3672
                • C:\Windows\SysWOW64\behk67e.exe
                  "C:\Windows\system32\behk67e.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3424
                  • C:\Windows\SysWOW64\mpsvef6.exe
                    "C:\Windows\system32\mpsvef6.exe"
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4900
                    • C:\Windows\SysWOW64\nqtw6f7.exe
                      "C:\Windows\system32\nqtw6f7.exe"
                      9⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4528
                      • C:\Windows\SysWOW64\gjmp7a6.exe
                        "C:\Windows\system32\gjmp7a6.exe"
                        10⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1700
                        • C:\Windows\SysWOW64\hknqd6e.exe
                          "C:\Windows\system32\hknqd6e.exe"
                          11⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3860
                          • C:\Windows\SysWOW64\hknqe36.exe
                            "C:\Windows\system32\hknqe36.exe"
                            12⤵
                              PID:4724
                              • C:\Windows\SysWOW64\gjmpf26.exe
                                "C:\Windows\system32\gjmpf26.exe"
                                13⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3900
                                • C:\Windows\SysWOW64\cfil537.exe
                                  "C:\Windows\system32\cfil537.exe"
                                  14⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:368
                                  • C:\Windows\SysWOW64\knqt4ee.exe
                                    "C:\Windows\system32\knqt4ee.exe"
                                    15⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1188
                                    • C:\Windows\SysWOW64\mpsvef7.exe
                                      "C:\Windows\system32\mpsvef7.exe"
                                      16⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3764
                                      • C:\Windows\SysWOW64\adgj7ff.exe
                                        "C:\Windows\system32\adgj7ff.exe"
                                        17⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4460
                                        • C:\Windows\SysWOW64\dgjm6bf.exe
                                          "C:\Windows\system32\dgjm6bf.exe"
                                          18⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4052
                                          • C:\Windows\SysWOW64\adgj7be.exe
                                            "C:\Windows\system32\adgj7be.exe"
                                            19⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2096
                                            • C:\Windows\SysWOW64\hknqf3e.exe
                                              "C:\Windows\system32\hknqf3e.exe"
                                              20⤵
                                                PID:888
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqf3e.exe > nul
                                                  21⤵
                                                    PID:1604
                                                  • C:\Windows\SysWOW64\nqtw46f.exe
                                                    "C:\Windows\system32\nqtw46f.exe"
                                                    21⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2972
                                                    • C:\Windows\SysWOW64\gjmp4ef.exe
                                                      "C:\Windows\system32\gjmp4ef.exe"
                                                      22⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2124
                                                      • C:\Windows\SysWOW64\filod37.exe
                                                        "C:\Windows\system32\filod37.exe"
                                                        23⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2612
                                                        • C:\Windows\SysWOW64\ilorc7e.exe
                                                          "C:\Windows\system32\ilorc7e.exe"
                                                          24⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2856
                                                          • C:\Windows\SysWOW64\adgjeb6.exe
                                                            "C:\Windows\system32\adgjeb6.exe"
                                                            25⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1580
                                                            • C:\Windows\SysWOW64\loru4ae.exe
                                                              "C:\Windows\system32\loru4ae.exe"
                                                              26⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:232
                                                              • C:\Windows\SysWOW64\hknq426.exe
                                                                "C:\Windows\system32\hknq426.exe"
                                                                27⤵
                                                                  PID:5080
                                                                  • C:\Windows\SysWOW64\knqtf67.exe
                                                                    "C:\Windows\system32\knqtf67.exe"
                                                                    28⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:324
                                                                    • C:\Windows\SysWOW64\knqtd26.exe
                                                                      "C:\Windows\system32\knqtd26.exe"
                                                                      29⤵
                                                                        PID:1372
                                                                        • C:\Windows\SysWOW64\loruc2f.exe
                                                                          "C:\Windows\system32\loruc2f.exe"
                                                                          30⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4280
                                                                          • C:\Windows\SysWOW64\knqtda7.exe
                                                                            "C:\Windows\system32\knqtda7.exe"
                                                                            31⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3008
                                                                            • C:\Windows\SysWOW64\jmpsf66.exe
                                                                              "C:\Windows\system32\jmpsf66.exe"
                                                                              32⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3328
                                                                              • C:\Windows\SysWOW64\dgjmd76.exe
                                                                                "C:\Windows\system32\dgjmd76.exe"
                                                                                33⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                PID:3696
                                                                                • C:\Windows\SysWOW64\nqtw5b6.exe
                                                                                  "C:\Windows\system32\nqtw5b6.exe"
                                                                                  34⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies registry class
                                                                                  PID:3092
                                                                                  • C:\Windows\SysWOW64\knqtc2f.exe
                                                                                    "C:\Windows\system32\knqtc2f.exe"
                                                                                    35⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    PID:4708
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtc2f.exe > nul
                                                                                      36⤵
                                                                                        PID:3560
                                                                                      • C:\Windows\SysWOW64\nqtwfe6.exe
                                                                                        "C:\Windows\system32\nqtwfe6.exe"
                                                                                        36⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        PID:3304
                                                                                        • C:\Windows\SysWOW64\hknqce6.exe
                                                                                          "C:\Windows\system32\hknqce6.exe"
                                                                                          37⤵
                                                                                            PID:920
                                                                                            • C:\Windows\SysWOW64\mpsv4e6.exe
                                                                                              "C:\Windows\system32\mpsv4e6.exe"
                                                                                              38⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              PID:3948
                                                                                              • C:\Windows\SysWOW64\mpsve77.exe
                                                                                                "C:\Windows\system32\mpsve77.exe"
                                                                                                39⤵
                                                                                                  PID:4728
                                                                                                  • C:\Windows\SysWOW64\loru53f.exe
                                                                                                    "C:\Windows\system32\loru53f.exe"
                                                                                                    40⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies registry class
                                                                                                    PID:4232
                                                                                                    • C:\Windows\SysWOW64\dgjm42e.exe
                                                                                                      "C:\Windows\system32\dgjm42e.exe"
                                                                                                      41⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:5080
                                                                                                      • C:\Windows\SysWOW64\loru4ff.exe
                                                                                                        "C:\Windows\system32\loru4ff.exe"
                                                                                                        42⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Modifies registry class
                                                                                                        PID:3512
                                                                                                        • C:\Windows\SysWOW64\cfil4e6.exe
                                                                                                          "C:\Windows\system32\cfil4e6.exe"
                                                                                                          43⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in System32 directory
                                                                                                          • Modifies registry class
                                                                                                          PID:4356
                                                                                                          • C:\Windows\SysWOW64\mpsvdbf.exe
                                                                                                            "C:\Windows\system32\mpsvdbf.exe"
                                                                                                            44⤵
                                                                                                              PID:1452
                                                                                                              • C:\Windows\SysWOW64\dgjmf6e.exe
                                                                                                                "C:\Windows\system32\dgjmf6e.exe"
                                                                                                                45⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies registry class
                                                                                                                PID:2348
                                                                                                                • C:\Windows\SysWOW64\cfil66e.exe
                                                                                                                  "C:\Windows\system32\cfil66e.exe"
                                                                                                                  46⤵
                                                                                                                    PID:2156
                                                                                                                    • C:\Windows\SysWOW64\mpsvebe.exe
                                                                                                                      "C:\Windows\system32\mpsvebe.exe"
                                                                                                                      47⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Modifies registry class
                                                                                                                      PID:4724
                                                                                                                      • C:\Windows\SysWOW64\dgjm6e7.exe
                                                                                                                        "C:\Windows\system32\dgjm6e7.exe"
                                                                                                                        48⤵
                                                                                                                          PID:1840
                                                                                                                          • C:\Windows\SysWOW64\cfileaf.exe
                                                                                                                            "C:\Windows\system32\cfileaf.exe"
                                                                                                                            49⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Modifies registry class
                                                                                                                            PID:1620
                                                                                                                            • C:\Windows\SysWOW64\nqtw5af.exe
                                                                                                                              "C:\Windows\system32\nqtw5af.exe"
                                                                                                                              50⤵
                                                                                                                                PID:4880
                                                                                                                                • C:\Windows\SysWOW64\behk77f.exe
                                                                                                                                  "C:\Windows\system32\behk77f.exe"
                                                                                                                                  51⤵
                                                                                                                                    PID:4860
                                                                                                                                    • C:\Windows\SysWOW64\ehknce7.exe
                                                                                                                                      "C:\Windows\system32\ehknce7.exe"
                                                                                                                                      52⤵
                                                                                                                                        PID:2604
                                                                                                                                        • C:\Windows\SysWOW64\behk7bf.exe
                                                                                                                                          "C:\Windows\system32\behk7bf.exe"
                                                                                                                                          53⤵
                                                                                                                                            PID:3680
                                                                                                                                            • C:\Windows\SysWOW64\jmps56e.exe
                                                                                                                                              "C:\Windows\system32\jmps56e.exe"
                                                                                                                                              54⤵
                                                                                                                                                PID:392
                                                                                                                                                • C:\Windows\SysWOW64\hknq437.exe
                                                                                                                                                  "C:\Windows\system32\hknq437.exe"
                                                                                                                                                  55⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:3508
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknq437.exe > nul
                                                                                                                                                    56⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:1840
                                                                                                                                                  • C:\Windows\SysWOW64\knqtc3e.exe
                                                                                                                                                    "C:\Windows\system32\knqtc3e.exe"
                                                                                                                                                    56⤵
                                                                                                                                                      PID:2076
                                                                                                                                                      • C:\Windows\SysWOW64\dgjm52e.exe
                                                                                                                                                        "C:\Windows\system32\dgjm52e.exe"
                                                                                                                                                        57⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:116
                                                                                                                                                        • C:\Windows\SysWOW64\behkd27.exe
                                                                                                                                                          "C:\Windows\system32\behkd27.exe"
                                                                                                                                                          58⤵
                                                                                                                                                            PID:992
                                                                                                                                                            • C:\Windows\SysWOW64\jmps6f6.exe
                                                                                                                                                              "C:\Windows\system32\jmps6f6.exe"
                                                                                                                                                              59⤵
                                                                                                                                                                PID:4684
                                                                                                                                                                • C:\Windows\SysWOW64\filo63f.exe
                                                                                                                                                                  "C:\Windows\system32\filo63f.exe"
                                                                                                                                                                  60⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:2072
                                                                                                                                                                  • C:\Windows\SysWOW64\loru7e6.exe
                                                                                                                                                                    "C:\Windows\system32\loru7e6.exe"
                                                                                                                                                                    61⤵
                                                                                                                                                                      PID:2836
                                                                                                                                                                      • C:\Windows\SysWOW64\ehkne27.exe
                                                                                                                                                                        "C:\Windows\system32\ehkne27.exe"
                                                                                                                                                                        62⤵
                                                                                                                                                                          PID:2396
                                                                                                                                                                          • C:\Windows\SysWOW64\hknqcef.exe
                                                                                                                                                                            "C:\Windows\system32\hknqcef.exe"
                                                                                                                                                                            63⤵
                                                                                                                                                                              PID:3868
                                                                                                                                                                              • C:\Windows\SysWOW64\filodef.exe
                                                                                                                                                                                "C:\Windows\system32\filodef.exe"
                                                                                                                                                                                64⤵
                                                                                                                                                                                  PID:1972
                                                                                                                                                                                  • C:\Windows\SysWOW64\ilor73e.exe
                                                                                                                                                                                    "C:\Windows\system32\ilor73e.exe"
                                                                                                                                                                                    65⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:1372
                                                                                                                                                                                    • C:\Windows\SysWOW64\filocf7.exe
                                                                                                                                                                                      "C:\Windows\system32\filocf7.exe"
                                                                                                                                                                                      66⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:4860
                                                                                                                                                                                      • C:\Windows\SysWOW64\hknq4e7.exe
                                                                                                                                                                                        "C:\Windows\system32\hknq4e7.exe"
                                                                                                                                                                                        67⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:860
                                                                                                                                                                                        • C:\Windows\SysWOW64\ilord7e.exe
                                                                                                                                                                                          "C:\Windows\system32\ilord7e.exe"
                                                                                                                                                                                          68⤵
                                                                                                                                                                                            PID:4876
                                                                                                                                                                                            • C:\Windows\SysWOW64\mpsve2f.exe
                                                                                                                                                                                              "C:\Windows\system32\mpsve2f.exe"
                                                                                                                                                                                              69⤵
                                                                                                                                                                                                PID:2288
                                                                                                                                                                                                • C:\Windows\SysWOW64\ilore77.exe
                                                                                                                                                                                                  "C:\Windows\system32\ilore77.exe"
                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                    • C:\Windows\SysWOW64\adgj626.exe
                                                                                                                                                                                                      "C:\Windows\system32\adgj626.exe"
                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                        PID:224
                                                                                                                                                                                                        • C:\Windows\SysWOW64\loru62e.exe
                                                                                                                                                                                                          "C:\Windows\system32\loru62e.exe"
                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                            PID:2704
                                                                                                                                                                                                            • C:\Windows\SysWOW64\dgjm7be.exe
                                                                                                                                                                                                              "C:\Windows\system32\dgjm7be.exe"
                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:920
                                                                                                                                                                                                              • C:\Windows\SysWOW64\gjmpd77.exe
                                                                                                                                                                                                                "C:\Windows\system32\gjmpd77.exe"
                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ilorfa6.exe
                                                                                                                                                                                                                    "C:\Windows\system32\ilorfa6.exe"
                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\filo6be.exe
                                                                                                                                                                                                                      "C:\Windows\system32\filo6be.exe"
                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\behkebe.exe
                                                                                                                                                                                                                          "C:\Windows\system32\behkebe.exe"
                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\filo52e.exe
                                                                                                                                                                                                                              "C:\Windows\system32\filo52e.exe"
                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ehkneb7.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\ehkneb7.exe"
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\knqtcff.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\knqtcff.exe"
                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\nqtw6e7.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\nqtw6e7.exe"
                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                            PID:436
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\nqtwdef.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\nqtwdef.exe"
                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                PID:4432
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hknqfe6.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\hknqfe6.exe"
                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                    PID:4648
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\gjmpcbe.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\gjmpcbe.exe"
                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                        PID:3696
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\filoeef.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\filoeef.exe"
                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                            PID:3048
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\filo72f.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\filo72f.exe"
                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\loruc76.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\loruc76.exe"
                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                    PID:2732
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hknq4ff.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\hknq4ff.exe"
                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                        PID:2736
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ilorc7e.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\ilorc7e.exe"
                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cfilda6.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\cfilda6.exe"
                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                PID:712
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\behk62f.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\behk62f.exe"
                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\dgjmf7f.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\dgjmf7f.exe"
                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                      PID:756
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\jmpsea6.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\jmpsea6.exe"
                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\adgje76.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\adgje76.exe"
                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:2076
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\behkf26.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\behkf26.exe"
                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                PID:264
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\gjmpe3e.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\gjmpe3e.exe"
                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\jmps6e6.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\jmps6e6.exe"
                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                        PID:4636
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\gjmpde6.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\gjmpde6.exe"
                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                            PID:1244
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmpde6.exe > nul
                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                PID:4596
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hknqf37.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\hknqf37.exe"
                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                  PID:4380
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\gjmpe26.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\gjmpe26.exe"
                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ehkncf7.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\ehkncf7.exe"
                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hknqdaf.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\hknqdaf.exe"
                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                              PID:1624
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\dgjm6af.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\dgjm6af.exe"
                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                  PID:4540
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\dgjm4f7.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\dgjm4f7.exe"
                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                      PID:2596
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\dgjme3e.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\dgjme3e.exe"
                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                          PID:3736
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\adgjcee.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\adgjcee.exe"
                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\dgjm6a7.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\dgjm6a7.exe"
                                                                                                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                                                                                                                PID:1776
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ehkn477.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\ehkn477.exe"
                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2412
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ilorefe.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\ilorefe.exe"
                                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mpsv727.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\mpsv727.exe"
                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3584
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\filofb7.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\filofb7.exe"
                                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                              PID:992
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\knqtfbf.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\knqtfbf.exe"
                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1088
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ehknf37.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\ehknf37.exe"
                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3328
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\adgj5bf.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\adgj5bf.exe"
                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cfil577.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cfil577.exe"
                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\knqt7bf.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\knqt7bf.exe"
                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1300
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\behke7e.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\behke7e.exe"
                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\adgjcfe.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\adgjcfe.exe"
                                                                                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:528
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\behk6f7.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\behk6f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2512
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\filoc26.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\filoc26.exe"
                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\adgje2f.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\adgje2f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\dgjmd6e.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\dgjmd6e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\behk6ff.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\behk6ff.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hknqdf6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\hknqdf6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ilor766.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\ilor766.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilor766.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ilordef.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\ilordef.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\knqt527.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\knqt527.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\nqtw47e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\nqtw47e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lorudf6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\lorudf6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\dgjm43f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\dgjm43f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ehkndaf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\ehkndaf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\jmpsc7f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\jmpsc7f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ehkn52f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\ehkn52f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hknqcff.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\hknqcff.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:392
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\behkde6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\behkde6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\knqtf77.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\knqtf77.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cfild6e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cfild6e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mpsvd6f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\mpsvd6f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\cfild6e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtf77.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behkde6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqcff.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehkn52f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\jmpsc7f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehkndaf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm43f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\lorudf6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtw47e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqt527.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilordef.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqdf6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behk6ff.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjmd6e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgje2f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filoc26.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behk6f7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgjcfe.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behke7e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqt7bf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\cfil577.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgj5bf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehknf37.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtfbf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filofb7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsv727.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilorefe.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehkn477.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm6a7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgjcee.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjme3e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm4f7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm6af.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqdaf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehkncf7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmpe26.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqf37.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\jmps6e6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmpe3e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behkf26.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgje76.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\jmpsea6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjmf7f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behk62f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\cfilda6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilorc7e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknq4ff.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loruc76.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filo72f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filoeef.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmpcbe.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqfe6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtwdef.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtw6e7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtcff.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehkneb7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filo52e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behkebe.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filo6be.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilorfa6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmpd77.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm7be.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loru62e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgj626.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilore77.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsve2f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilord7e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknq4e7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filocf7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilor73e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filodef.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqcef.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehkne27.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loru7e6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filo63f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\jmps6f6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behkd27.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm52e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtc3e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\jmps56e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behk7bf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ehknce7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behk77f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtw5af.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\cfileaf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm6e7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsvebe.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\cfil66e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjmf6e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsvdbf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\cfil4e6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loru4ff.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm42e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loru53f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsve77.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsv4e6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqce6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtwfe6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtw5b6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjmd76.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\jmpsf66.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtda7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loruc2f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtd26.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqtf67.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknq426.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loru4ae.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgjeb6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilorc7e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\filod37.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmp4ef.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtw46f.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgj7be.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\dgjm6bf.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\adgj7ff.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsvef7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\knqt4ee.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\cfil537.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmpf26.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqe36.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\hknqd6e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\gjmp7a6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtw6f7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\mpsvef6.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behk67e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\behkcfe.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\nqtw4ee.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\ilor47e.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c delC:\Windows\SysWOW64\loru5a7.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c delC:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2324

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\loru5a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                16e64b83933c0ea42ec9de131c4d2527

                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                2d608bd9a248701068c50b8d6f9ca2d4150d8261

                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                b32781dffffaddc2ccab6f76dd0044894c2e3db8346bfc5e4e0d09624fee14c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                927403fd454f786d1f91673fd32a0812e43700065699ef139443ebe03e3a3fbb8e159f5324cbce42de5f7141ac302e38a944d85ebdf62b9825d48553b6996f87

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit