Overview

overview

7

Static

static

3

76178d922e...cs.exe

windows7-x64

7

76178d922e...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 22:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    76178d922ed65f02a87c14e2aec6aa30_NeikiAnalytics.exe
  • Size 93KB
  • Sample240602-2a3elsac29
  • SHA256 b2c9ea8f80a3571061ab48cc9635d0ff81db3a3d3e1944da3510bccd39e37f30
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76178d922ed65f02a87c14e2aec6aa30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\76178d922ed65f02a87c14e2aec6aa30_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\SysWOW64\wdwd.exe
      "C:\Windows\system32\wdwd.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\wwmxcv.exe
        "C:\Windows\system32\wwmxcv.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:4580
        • C:\Windows\SysWOW64\wofgfe.exe
          "C:\Windows\system32\wofgfe.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Windows\SysWOW64\wdkjl.exe
            "C:\Windows\system32\wdkjl.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:3832
            • C:\Windows\SysWOW64\wdimk.exe
              "C:\Windows\system32\wdimk.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:2280
              • C:\Windows\SysWOW64\wjtcs.exe
                "C:\Windows\system32\wjtcs.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3652
                • C:\Windows\SysWOW64\wchdd.exe
                  "C:\Windows\system32\wchdd.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:1724
                  • C:\Windows\SysWOW64\wgsvtgt.exe
                    "C:\Windows\system32\wgsvtgt.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:2016
                    • C:\Windows\SysWOW64\wsaxywuvg.exe
                      "C:\Windows\system32\wsaxywuvg.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • Suspicious use of WriteProcessMemory
                      PID:4848
                      • C:\Windows\SysWOW64\wqmtatj.exe
                        "C:\Windows\system32\wqmtatj.exe"
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:3920
                        • C:\Windows\SysWOW64\wpcwl.exe
                          "C:\Windows\system32\wpcwl.exe"
                          12⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:528
                          • C:\Windows\SysWOW64\wmscglx.exe
                            "C:\Windows\system32\wmscglx.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Adds Run key to start application
                            PID:2640
                            • C:\Windows\SysWOW64\weabdrd.exe
                              "C:\Windows\system32\weabdrd.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              PID:2264
                              • C:\Windows\SysWOW64\wovwjqpg.exe
                                "C:\Windows\system32\wovwjqpg.exe"
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in System32 directory
                                PID:4624
                                • C:\Windows\SysWOW64\wkmceq.exe
                                  "C:\Windows\system32\wkmceq.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  PID:544
                                  • C:\Windows\SysWOW64\wgosgslg.exe
                                    "C:\Windows\system32\wgosgslg.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Drops file in System32 directory
                                    PID:1332
                                    • C:\Windows\SysWOW64\wwihvxdt.exe
                                      "C:\Windows\system32\wwihvxdt.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:3032
                                      • C:\Windows\SysWOW64\wcjnghnr.exe
                                        "C:\Windows\system32\wcjnghnr.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in System32 directory
                                        PID:2636
                                        • C:\Windows\SysWOW64\wdh.exe
                                          "C:\Windows\system32\wdh.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          PID:1600
                                          • C:\Windows\SysWOW64\whwpgg.exe
                                            "C:\Windows\system32\whwpgg.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            PID:3696
                                            • C:\Windows\SysWOW64\waoykoh.exe
                                              "C:\Windows\system32\waoykoh.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              PID:4748
                                              • C:\Windows\SysWOW64\wueeeoab.exe
                                                "C:\Windows\system32\wueeeoab.exe"
                                                23⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                PID:4456
                                                • C:\Windows\SysWOW64\wmvoix.exe
                                                  "C:\Windows\system32\wmvoix.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Drops file in System32 directory
                                                  PID:3628
                                                  • C:\Windows\SysWOW64\wrsny.exe
                                                    "C:\Windows\system32\wrsny.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    PID:4516
                                                    • C:\Windows\SysWOW64\wmpyxcxu.exe
                                                      "C:\Windows\system32\wmpyxcxu.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      PID:1372
                                                      • C:\Windows\SysWOW64\wyv.exe
                                                        "C:\Windows\system32\wyv.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        PID:1576
                                                        • C:\Windows\SysWOW64\wmeeik.exe
                                                          "C:\Windows\system32\wmeeik.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Drops file in System32 directory
                                                          PID:1916
                                                          • C:\Windows\SysWOW64\wjtkdkqx.exe
                                                            "C:\Windows\system32\wjtkdkqx.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Drops file in System32 directory
                                                            PID:2116
                                                            • C:\Windows\SysWOW64\wfafq.exe
                                                              "C:\Windows\system32\wfafq.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Adds Run key to start application
                                                              • Drops file in System32 directory
                                                              PID:2880
                                                              • C:\Windows\SysWOW64\wbpklj.exe
                                                                "C:\Windows\system32\wbpklj.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                PID:716
                                                                • C:\Windows\SysWOW64\wiqe.exe
                                                                  "C:\Windows\system32\wiqe.exe"
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  PID:1456
                                                                  • C:\Windows\SysWOW64\wjmhtak.exe
                                                                    "C:\Windows\system32\wjmhtak.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    PID:2376
                                                                    • C:\Windows\SysWOW64\wbshqho.exe
                                                                      "C:\Windows\system32\wbshqho.exe"
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:4960
                                                                      • C:\Windows\SysWOW64\wvuvr.exe
                                                                        "C:\Windows\system32\wvuvr.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        PID:4612
                                                                        • C:\Windows\SysWOW64\wgrryg.exe
                                                                          "C:\Windows\system32\wgrryg.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Drops file in System32 directory
                                                                          PID:740
                                                                          • C:\Windows\SysWOW64\wyicdor.exe
                                                                            "C:\Windows\system32\wyicdor.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • Drops file in System32 directory
                                                                            PID:4088
                                                                            • C:\Windows\SysWOW64\wmoei.exe
                                                                              "C:\Windows\system32\wmoei.exe"
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              PID:1008
                                                                              • C:\Windows\SysWOW64\woliqm.exe
                                                                                "C:\Windows\system32\woliqm.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                • Drops file in System32 directory
                                                                                PID:396
                                                                                • C:\Windows\SysWOW64\wvso.exe
                                                                                  "C:\Windows\system32\wvso.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  PID:4184
                                                                                  • C:\Windows\SysWOW64\wkyrkcw.exe
                                                                                    "C:\Windows\system32\wkyrkcw.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    PID:4372
                                                                                    • C:\Windows\SysWOW64\wehmpb.exe
                                                                                      "C:\Windows\system32\wehmpb.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      PID:32
                                                                                      • C:\Windows\SysWOW64\wwbbfi.exe
                                                                                        "C:\Windows\system32\wwbbfi.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • Drops file in System32 directory
                                                                                        PID:3876
                                                                                        • C:\Windows\SysWOW64\wqe.exe
                                                                                          "C:\Windows\system32\wqe.exe"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          PID:4952
                                                                                          • C:\Windows\SysWOW64\wniluimb.exe
                                                                                            "C:\Windows\system32\wniluimb.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            PID:3472
                                                                                            • C:\Windows\SysWOW64\wtglk.exe
                                                                                              "C:\Windows\system32\wtglk.exe"
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • Drops file in System32 directory
                                                                                              PID:4408
                                                                                              • C:\Windows\SysWOW64\wjvkwx.exe
                                                                                                "C:\Windows\system32\wjvkwx.exe"
                                                                                                47⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in System32 directory
                                                                                                PID:2032
                                                                                                • C:\Windows\SysWOW64\wbcjt.exe
                                                                                                  "C:\Windows\system32\wbcjt.exe"
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Adds Run key to start application
                                                                                                  • Drops file in System32 directory
                                                                                                  PID:428
                                                                                                  • C:\Windows\SysWOW64\wfp.exe
                                                                                                    "C:\Windows\system32\wfp.exe"
                                                                                                    49⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    PID:1188
                                                                                                    • C:\Windows\SysWOW64\wcbxlnyl.exe
                                                                                                      "C:\Windows\system32\wcbxlnyl.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • Drops file in System32 directory
                                                                                                      PID:3180
                                                                                                      • C:\Windows\SysWOW64\whqw.exe
                                                                                                        "C:\Windows\system32\whqw.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Adds Run key to start application
                                                                                                        PID:4816
                                                                                                        • C:\Windows\SysWOW64\wyig.exe
                                                                                                          "C:\Windows\system32\wyig.exe"
                                                                                                          52⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Adds Run key to start application
                                                                                                          • Drops file in System32 directory
                                                                                                          PID:4680
                                                                                                          • C:\Windows\SysWOW64\wtxkmf.exe
                                                                                                            "C:\Windows\system32\wtxkmf.exe"
                                                                                                            53⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2456
                                                                                                            • C:\Windows\SysWOW64\wakavl.exe
                                                                                                              "C:\Windows\system32\wakavl.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              • Drops file in System32 directory
                                                                                                              PID:2324
                                                                                                              • C:\Windows\SysWOW64\wjsh.exe
                                                                                                                "C:\Windows\system32\wjsh.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Adds Run key to start application
                                                                                                                PID:384
                                                                                                                • C:\Windows\SysWOW64\wajp.exe
                                                                                                                  "C:\Windows\system32\wajp.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Adds Run key to start application
                                                                                                                  PID:4592
                                                                                                                  • C:\Windows\SysWOW64\wbu.exe
                                                                                                                    "C:\Windows\system32\wbu.exe"
                                                                                                                    57⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:2700
                                                                                                                    • C:\Windows\SysWOW64\whdt.exe
                                                                                                                      "C:\Windows\system32\whdt.exe"
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Adds Run key to start application
                                                                                                                      • Drops file in System32 directory
                                                                                                                      PID:1372
                                                                                                                      • C:\Windows\SysWOW64\wjmqss.exe
                                                                                                                        "C:\Windows\system32\wjmqss.exe"
                                                                                                                        59⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in System32 directory
                                                                                                                        PID:3560
                                                                                                                        • C:\Windows\SysWOW64\wot.exe
                                                                                                                          "C:\Windows\system32\wot.exe"
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:5080
                                                                                                                          • C:\Windows\SysWOW64\wwuf.exe
                                                                                                                            "C:\Windows\system32\wwuf.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3108
                                                                                                                            • C:\Windows\SysWOW64\wkciuri.exe
                                                                                                                              "C:\Windows\system32\wkciuri.exe"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in System32 directory
                                                                                                                              PID:1584
                                                                                                                              • C:\Windows\SysWOW64\wtxed.exe
                                                                                                                                "C:\Windows\system32\wtxed.exe"
                                                                                                                                63⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Adds Run key to start application
                                                                                                                                PID:3576
                                                                                                                                • C:\Windows\SysWOW64\wdtyln.exe
                                                                                                                                  "C:\Windows\system32\wdtyln.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1596
                                                                                                                                  • C:\Windows\SysWOW64\wvkjov.exe
                                                                                                                                    "C:\Windows\system32\wvkjov.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:1732
                                                                                                                                    • C:\Windows\SysWOW64\wegfvth.exe
                                                                                                                                      "C:\Windows\system32\wegfvth.exe"
                                                                                                                                      66⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      PID:2716
                                                                                                                                      • C:\Windows\SysWOW64\wnavpu.exe
                                                                                                                                        "C:\Windows\system32\wnavpu.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:5052
                                                                                                                                        • C:\Windows\SysWOW64\wcuoojeg.exe
                                                                                                                                          "C:\Windows\system32\wcuoojeg.exe"
                                                                                                                                          68⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          PID:4404
                                                                                                                                          • C:\Windows\SysWOW64\whrnf.exe
                                                                                                                                            "C:\Windows\system32\whrnf.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:3964
                                                                                                                                            • C:\Windows\SysWOW64\wlnouvttt.exe
                                                                                                                                              "C:\Windows\system32\wlnouvttt.exe"
                                                                                                                                              70⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:4716
                                                                                                                                              • C:\Windows\SysWOW64\wtyrlyt.exe
                                                                                                                                                "C:\Windows\system32\wtyrlyt.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:3608
                                                                                                                                                • C:\Windows\SysWOW64\wkpa.exe
                                                                                                                                                  "C:\Windows\system32\wkpa.exe"
                                                                                                                                                  72⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  PID:884
                                                                                                                                                  • C:\Windows\SysWOW64\wlfdby.exe
                                                                                                                                                    "C:\Windows\system32\wlfdby.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:5080
                                                                                                                                                    • C:\Windows\SysWOW64\wud.exe
                                                                                                                                                      "C:\Windows\system32\wud.exe"
                                                                                                                                                      74⤵
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      PID:404
                                                                                                                                                      • C:\Windows\SysWOW64\wrhict.exe
                                                                                                                                                        "C:\Windows\system32\wrhict.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:1492
                                                                                                                                                        • C:\Windows\SysWOW64\wgcad.exe
                                                                                                                                                          "C:\Windows\system32\wgcad.exe"
                                                                                                                                                          76⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:4292
                                                                                                                                                          • C:\Windows\SysWOW64\wstnn.exe
                                                                                                                                                            "C:\Windows\system32\wstnn.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            PID:3084
                                                                                                                                                            • C:\Windows\SysWOW64\whqglp.exe
                                                                                                                                                              "C:\Windows\system32\whqglp.exe"
                                                                                                                                                              78⤵
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              PID:4748
                                                                                                                                                              • C:\Windows\SysWOW64\wgqrfi.exe
                                                                                                                                                                "C:\Windows\system32\wgqrfi.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                PID:2456
                                                                                                                                                                • C:\Windows\SysWOW64\wvnj.exe
                                                                                                                                                                  "C:\Windows\system32\wvnj.exe"
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  PID:996
                                                                                                                                                                  • C:\Windows\SysWOW64\webqftr.exe
                                                                                                                                                                    "C:\Windows\system32\webqftr.exe"
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    PID:4304
                                                                                                                                                                    • C:\Windows\SysWOW64\wtwkd.exe
                                                                                                                                                                      "C:\Windows\system32\wtwkd.exe"
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      PID:936
                                                                                                                                                                      • C:\Windows\SysWOW64\wsxw.exe
                                                                                                                                                                        "C:\Windows\system32\wsxw.exe"
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        PID:2756
                                                                                                                                                                        • C:\Windows\SysWOW64\wsoyhtkl.exe
                                                                                                                                                                          "C:\Windows\system32\wsoyhtkl.exe"
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:1336
                                                                                                                                                                          • C:\Windows\SysWOW64\wxvheacs.exe
                                                                                                                                                                            "C:\Windows\system32\wxvheacs.exe"
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            PID:1132
                                                                                                                                                                            • C:\Windows\SysWOW64\wkdk.exe
                                                                                                                                                                              "C:\Windows\system32\wkdk.exe"
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              PID:3648
                                                                                                                                                                              • C:\Windows\SysWOW64\wyydih.exe
                                                                                                                                                                                "C:\Windows\system32\wyydih.exe"
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                PID:4520
                                                                                                                                                                                • C:\Windows\SysWOW64\wvoichl.exe
                                                                                                                                                                                  "C:\Windows\system32\wvoichl.exe"
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  PID:4220
                                                                                                                                                                                  • C:\Windows\SysWOW64\wivliv.exe
                                                                                                                                                                                    "C:\Windows\system32\wivliv.exe"
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    PID:3944
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvoichl.exe"
                                                                                                                                                                                    89⤵
                                                                                                                                                                                      PID:4372
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyydih.exe"
                                                                                                                                                                                    88⤵
                                                                                                                                                                                      PID:1020
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkdk.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                      PID:1936
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxvheacs.exe"
                                                                                                                                                                                    86⤵
                                                                                                                                                                                      PID:4324
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsoyhtkl.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                      PID:1452
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsxw.exe"
                                                                                                                                                                                    84⤵
                                                                                                                                                                                      PID:3396
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtwkd.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                      PID:3964
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\webqftr.exe"
                                                                                                                                                                                    82⤵
                                                                                                                                                                                      PID:4448
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvnj.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                      PID:4596
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgqrfi.exe"
                                                                                                                                                                                    80⤵
                                                                                                                                                                                      PID:3544
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whqglp.exe"
                                                                                                                                                                                    79⤵
                                                                                                                                                                                      PID:544
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wstnn.exe"
                                                                                                                                                                                    78⤵
                                                                                                                                                                                      PID:4560
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgcad.exe"
                                                                                                                                                                                    77⤵
                                                                                                                                                                                      PID:4104
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrhict.exe"
                                                                                                                                                                                    76⤵
                                                                                                                                                                                      PID:2640
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wud.exe"
                                                                                                                                                                                    75⤵
                                                                                                                                                                                      PID:1928
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlfdby.exe"
                                                                                                                                                                                    74⤵
                                                                                                                                                                                      PID:2516
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkpa.exe"
                                                                                                                                                                                    73⤵
                                                                                                                                                                                      PID:3920
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtyrlyt.exe"
                                                                                                                                                                                    72⤵
                                                                                                                                                                                      PID:1208
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlnouvttt.exe"
                                                                                                                                                                                    71⤵
                                                                                                                                                                                      PID:4640
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whrnf.exe"
                                                                                                                                                                                    70⤵
                                                                                                                                                                                      PID:1804
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcuoojeg.exe"
                                                                                                                                                                                    69⤵
                                                                                                                                                                                      PID:2628
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnavpu.exe"
                                                                                                                                                                                    68⤵
                                                                                                                                                                                      PID:4260
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1460
                                                                                                                                                                                      68⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:5020
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1444
                                                                                                                                                                                      68⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:3924
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wegfvth.exe"
                                                                                                                                                                                    67⤵
                                                                                                                                                                                      PID:4180
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvkjov.exe"
                                                                                                                                                                                    66⤵
                                                                                                                                                                                      PID:4836
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdtyln.exe"
                                                                                                                                                                                    65⤵
                                                                                                                                                                                      PID:3140
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtxed.exe"
                                                                                                                                                                                    64⤵
                                                                                                                                                                                      PID:1836
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkciuri.exe"
                                                                                                                                                                                    63⤵
                                                                                                                                                                                      PID:1536
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwuf.exe"
                                                                                                                                                                                    62⤵
                                                                                                                                                                                      PID:2516
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wot.exe"
                                                                                                                                                                                    61⤵
                                                                                                                                                                                      PID:4492
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjmqss.exe"
                                                                                                                                                                                    60⤵
                                                                                                                                                                                      PID:4848
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 1536
                                                                                                                                                                                      60⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:1188
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whdt.exe"
                                                                                                                                                                                    59⤵
                                                                                                                                                                                      PID:2032
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbu.exe"
                                                                                                                                                                                    58⤵
                                                                                                                                                                                      PID:4716
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wajp.exe"
                                                                                                                                                                                    57⤵
                                                                                                                                                                                      PID:4928
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjsh.exe"
                                                                                                                                                                                    56⤵
                                                                                                                                                                                      PID:5040
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wakavl.exe"
                                                                                                                                                                                    55⤵
                                                                                                                                                                                      PID:4452
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtxkmf.exe"
                                                                                                                                                                                    54⤵
                                                                                                                                                                                      PID:3004
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyig.exe"
                                                                                                                                                                                    53⤵
                                                                                                                                                                                      PID:1960
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whqw.exe"
                                                                                                                                                                                    52⤵
                                                                                                                                                                                      PID:1936
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcbxlnyl.exe"
                                                                                                                                                                                    51⤵
                                                                                                                                                                                      PID:4652
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfp.exe"
                                                                                                                                                                                    50⤵
                                                                                                                                                                                      PID:5012
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbcjt.exe"
                                                                                                                                                                                    49⤵
                                                                                                                                                                                      PID:3244
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjvkwx.exe"
                                                                                                                                                                                    48⤵
                                                                                                                                                                                      PID:4392
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtglk.exe"
                                                                                                                                                                                    47⤵
                                                                                                                                                                                      PID:4396
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wniluimb.exe"
                                                                                                                                                                                    46⤵
                                                                                                                                                                                      PID:3804
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqe.exe"
                                                                                                                                                                                    45⤵
                                                                                                                                                                                      PID:2000
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwbbfi.exe"
                                                                                                                                                                                    44⤵
                                                                                                                                                                                      PID:3768
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wehmpb.exe"
                                                                                                                                                                                    43⤵
                                                                                                                                                                                      PID:508
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkyrkcw.exe"
                                                                                                                                                                                    42⤵
                                                                                                                                                                                      PID:4824
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvso.exe"
                                                                                                                                                                                    41⤵
                                                                                                                                                                                      PID:4016
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woliqm.exe"
                                                                                                                                                                                    40⤵
                                                                                                                                                                                      PID:4856
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmoei.exe"
                                                                                                                                                                                    39⤵
                                                                                                                                                                                      PID:3428
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyicdor.exe"
                                                                                                                                                                                    38⤵
                                                                                                                                                                                      PID:1132
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgrryg.exe"
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:936
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvuvr.exe"
                                                                                                                                                                                    36⤵
                                                                                                                                                                                      PID:2500
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbshqho.exe"
                                                                                                                                                                                    35⤵
                                                                                                                                                                                      PID:2392
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjmhtak.exe"
                                                                                                                                                                                    34⤵
                                                                                                                                                                                      PID:2424
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wiqe.exe"
                                                                                                                                                                                    33⤵
                                                                                                                                                                                      PID:3080
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbpklj.exe"
                                                                                                                                                                                    32⤵
                                                                                                                                                                                      PID:3980
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfafq.exe"
                                                                                                                                                                                    31⤵
                                                                                                                                                                                      PID:840
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjtkdkqx.exe"
                                                                                                                                                                                    30⤵
                                                                                                                                                                                      PID:4288
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmeeik.exe"
                                                                                                                                                                                    29⤵
                                                                                                                                                                                      PID:2420
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyv.exe"
                                                                                                                                                                                    28⤵
                                                                                                                                                                                      PID:3388
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmpyxcxu.exe"
                                                                                                                                                                                    27⤵
                                                                                                                                                                                      PID:2012
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 1688
                                                                                                                                                                                      27⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:868
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrsny.exe"
                                                                                                                                                                                    26⤵
                                                                                                                                                                                      PID:4548
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1664
                                                                                                                                                                                      26⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:1528
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmvoix.exe"
                                                                                                                                                                                    25⤵
                                                                                                                                                                                      PID:4920
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wueeeoab.exe"
                                                                                                                                                                                    24⤵
                                                                                                                                                                                      PID:3080
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waoykoh.exe"
                                                                                                                                                                                    23⤵
                                                                                                                                                                                      PID:2316
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whwpgg.exe"
                                                                                                                                                                                    22⤵
                                                                                                                                                                                      PID:3832
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdh.exe"
                                                                                                                                                                                    21⤵
                                                                                                                                                                                      PID:2712
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcjnghnr.exe"
                                                                                                                                                                                    20⤵
                                                                                                                                                                                      PID:808
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwihvxdt.exe"
                                                                                                                                                                                    19⤵
                                                                                                                                                                                      PID:5112
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgosgslg.exe"
                                                                                                                                                                                    18⤵
                                                                                                                                                                                      PID:4696
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkmceq.exe"
                                                                                                                                                                                    17⤵
                                                                                                                                                                                      PID:2664
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wovwjqpg.exe"
                                                                                                                                                                                    16⤵
                                                                                                                                                                                      PID:1648
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weabdrd.exe"
                                                                                                                                                                                    15⤵
                                                                                                                                                                                      PID:2456
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmscglx.exe"
                                                                                                                                                                                    14⤵
                                                                                                                                                                                      PID:4164
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpcwl.exe"
                                                                                                                                                                                    13⤵
                                                                                                                                                                                      PID:2856
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqmtatj.exe"
                                                                                                                                                                                    12⤵
                                                                                                                                                                                      PID:808
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsaxywuvg.exe"
                                                                                                                                                                                    11⤵
                                                                                                                                                                                      PID:2860
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgsvtgt.exe"
                                                                                                                                                                                    10⤵
                                                                                                                                                                                      PID:2000
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wchdd.exe"
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:4788
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjtcs.exe"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:4340
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1192
                                                                                                                                                                                      8⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:2616
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdimk.exe"
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:2316
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdkjl.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:4768
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wofgfe.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1188
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwmxcv.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:2852
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdwd.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2908
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1388
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:4592
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\76178d922ed65f02a87c14e2aec6aa30_NeikiAnalytics.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2604
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1528 -ip 1528
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:436
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3652 -ip 3652
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1584
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4516 -ip 4516
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2604
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1372 -ip 1372
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4408
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3560 -ip 3560
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3896
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5052 -ip 5052
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4588
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5052 -ip 5052
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4468

                                                                                                                                                                                                Network

                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                      waoykoh.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\waoykoh.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 5d7a08834a8d210e1b13d10b6fa666ae799c84093a1b7c847b26036ecfe609d5
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wbpklj.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wbpklj.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 dce1f0140c857fe47cf08b7dc76861a9434d3ad9879ce9d749513749994831af
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wchdd.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wchdd.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 0224a801bf3d2af5179684ab46ce3a61b4bb8c2b5dc14c4b81502c661116ca97
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wcjnghnr.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wcjnghnr.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 ea087dd0121996e88f310243491925244904c70a968de45c95206cfb006ef11c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wdh.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wdh.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 55830715505f4bb52132d00636352fdbbcab96d04d5383b2f578594eba6569f2
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wdimk.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wdimk.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 178e0c88f4d44dcb95361daf18e8e0f374569dbe25cb0e775e7f09634460ff9d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wdkjl.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wdkjl.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 014f61077e735e371ef56b2564b7758654b454715707ddf557c35633ddc5d957
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wdwd.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wdwd.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 fe2417e9d73dfdf5da9de843e9bb699da7e4456056744227b12c18da72072e8e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      weabdrd.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\weabdrd.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 6ab89ba65413acfc2be56ed58077d5384ed4ce821d938490768d451164c40016
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wfafq.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wfafq.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 648999d7211183cdd76e1c52b4c914bcbcdf75bd80eefe829e0f81e0afdaaafa
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wgosgslg.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wgosgslg.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 01b588dc32c9207da8e0e5f7de33a3ea0fa5357af3980882b58bf35a85cc8c75
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wgsvtgt.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wgsvtgt.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 857ebbb051aab9c63422a559abba986878d2286bee88db2de605ee47883ccb1e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      whwpgg.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\whwpgg.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 f2de9f47b421bc104308b953bafd60c0df27fad17b596f2113639ba033ba84fd
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wiqe.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wiqe.exe
                                                                                                                                                                                                      • Size 94KB
                                                                                                                                                                                                      • SHA256 79298ce2ac10223fa3b11be5e62a4a56ab39cb854a107a758799476cd77df56c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wjmhtak.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wjmhtak.exe
                                                                                                                                                                                                      • Size 94KB
                                                                                                                                                                                                      • SHA256 d101476e1b4024ccb6d15744974059fe452ddb179676086a8ea718ac86f7da4c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wjtcs.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wjtcs.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 5887527ff70b11ff0b0972c1e5ec329d81d3e70dbc60480ce82a1a2773dfb365
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wjtkdkqx.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wjtkdkqx.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 b2d5de533af46479b75daf0a8e3fde8eebff0b953a36960826746f4d5382260d
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wkmceq.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wkmceq.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 f70bfb13f4d774117fa6288745aa299756948f3d1d6d77c3155c6d46cc5a9feb
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wmeeik.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wmeeik.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 c9b80818dbd18a9019cc7e5d68ff40d8ed63a4ea410c1a75749298203c7dc1ba
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wmpyxcxu.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wmpyxcxu.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 6470ef4d1f9ae3f02bc2c4521cf5af72b278b54dcc050220019ebd52879819d4
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wmscglx.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wmscglx.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 56999b2f08e49afae1e473123524544244ce9373921fb9b443c0974935564bd8
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wmvoix.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wmvoix.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 bf97f3464593f4b235d8739b94b376ca25d2ce14c6b427d91737106f26650d25
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wofgfe.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wofgfe.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 1009137f75894ae03b63dc54c615ea9cca8e8074471d93c7e6d6319612ecba8c
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wovwjqpg.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wovwjqpg.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 94d1e3dc79544a3361eb02257c39ed5850e841a388708331199a33b70ce93209
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wpcwl.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wpcwl.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 df7331ba2e88798ada9dc74ff59fe192cb05ecfe4318978a2692d6c27523b703
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wqmtatj.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wqmtatj.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 59f382f39fc10c2ecac47eaf99e2741fdc9938dd4d96c96d0a0bc64a5fc3a49e
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wrsny.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wrsny.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 c7869358466a8946e0284f7a71f1d6c3d5c3565b737dc36bd45847ac49f25281
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wsaxywuvg.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wsaxywuvg.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 6b2fd38adfd09f31ff41201322a9e349146133d97c2cac23e97890cfdf77fdbd
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wueeeoab.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wueeeoab.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 193250d92de4d0ae3369bc109f3d5f1a8151beafc47b2a2aec6d86d49234c109
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wwihvxdt.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wwihvxdt.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 38d7b99b380824d392ddcd90cf2fb724c9b877229161f4b24c0f7e7ae3063dff
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wwmxcv.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wwmxcv.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 1c1bdbcf82eb7395a691ec560d2d750f44b5c1ea8332ef7b6213c1dce50f56b0
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      wyv.exe
                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\wyv.exe
                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                      • SHA256 6885e37aa715a0015125f290f78b42996d82abdbfc187176ec75e732e6a97f99
                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                      memory/32-414-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/384-524-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/396-389-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/428-465-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/528-126-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/528-115-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/544-157-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/544-169-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/716-321-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/716-310-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/740-364-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1008-381-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1188-464-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1188-473-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1332-179-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1332-168-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1372-270-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1372-550-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1456-332-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1528-20-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1576-280-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1584-582-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1596-598-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1600-210-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1724-84-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1724-72-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1732-606-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/1916-290-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2016-95-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2016-83-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2032-456-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2116-300-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2264-147-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2280-62-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2324-516-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2324-507-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2376-331-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2376-340-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2456-508-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2456-498-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2636-200-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2636-189-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2640-136-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2700-542-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2700-533-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2716-615-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/2880-311-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3032-190-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3108-573-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3180-482-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3472-440-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3472-431-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3576-590-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3576-581-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3608-648-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3628-251-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3652-73-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3696-220-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3832-52-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3832-41-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3876-423-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3876-413-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3920-116-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/3964-640-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4088-365-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4088-373-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4184-397-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4280-10-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4280-0-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4372-405-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4404-632-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4404-623-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4408-448-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4456-240-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4516-250-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4580-31-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4592-525-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4592-534-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4612-356-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4624-146-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4624-158-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4680-499-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4716-649-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4748-230-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4816-481-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4816-490-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4848-94-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4848-105-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4952-432-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4952-422-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4956-42-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4956-30-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/4960-348-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/5052-614-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/5052-624-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download

                                                                                                                                                                                                      memory/5080-565-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                      Download