metasploit | 6d1d41b1f4df5c76e9f8a82469471cc9eb623c08fda2be0554c3e20ccd775af1

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe
Size

792KB
MD5

f7a1a4ec8ee1f0504378264b77c200cf
SHA1

afafcaff5c683e70324298d6fe75fdbaba506296
SHA256

6d1d41b1f4df5c76e9f8a82469471cc9eb623c08fda2be0554c3e20ccd775af1
SHA512

d6d1c8d8775d8d6c52548f8765200320d79ffe01948ec5629c961b227bd8024ff7dfeb9c0610797cbebed845eab3cbfe5096bbaf6e43e6719192c07e6aceb174
SSDEEP

12288:27lo5CZDPH2fpcx/c6V2NNHbScrXOL+ikJvRg597+QKUvrISSLqD3/HsN:e/DPHFx/cmqY7kJ59aIDq7

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks BIOS information in registry 2 TTPs 64 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	dzzoezq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cwapgrc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	awtglok.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	rkgnebh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amrgyaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lkkqill.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vkoesqy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vlclzza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	frrzegc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	yvrgqtz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	udugjob.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	acahohp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	japqaqq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	gzrbcmu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cwkonyf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cvxehwp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntcffdu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vxmkowx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	dihfqcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sagshkr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	zdffxee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrduxom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ntrugjh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tsxroid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	jezxqle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	zwxijeb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	gpwdwyh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	laypaas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vlvprmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iwqimig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	cfonvia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ubwwvza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ynglkqs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wysjics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ahcoctx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hhnxfvf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	rlpcikl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xxitobk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	zizacka.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	uggekwf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	hfqipvb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	hyzloam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mwgrhva.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rxyubyd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	upcebro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	owxwirt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	qpxuwxi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ieknpmh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bwbfbda.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ydbmmxw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	bradxmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lufwcwg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dzzoezq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	zmmpltm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	kwlesfp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cwgtsiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oabyzad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lqtgdvz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	morkgtc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	jvynhbo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ollapce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	jvynhbo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mwgrhva.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rjaemfd.exe

Executes dropped EXE 64 IoCs

pid	Process
3968	gykhptx.exe
2776	jezxqle.exe
4684	tmfzurj.exe
1392	tepxadq.exe
3324	bmldgbx.exe
756	tilnckc.exe
1372	ozfqrzl.exe
3992	lladpts.exe
3696	gzrbcmu.exe
4788	qyvzulc.exe
1956	qnteltf.exe
4264	inwckzr.exe
968	qzgclfh.exe
5108	acumnpz.exe
1464	naxpwxx.exe
3004	syuxjye.exe
3816	ywrnxrd.exe
3276	vuynqyi.exe
228	iveqtxi.exe
452	sguagbo.exe
4544	ftlqmev.exe
2956	qlbvzvp.exe
760	vxudswc.exe
4780	nmuoggh.exe
2316	lufwcwg.exe
704	nmwmuso.exe
4396	qtkwjsp.exe
2456	yljoqyt.exe
4012	dgdrbvt.exe
312	fbguwva.exe
3832	ihmflnj.exe
960	sdnptik.exe
3568	yphsdek.exe
4856	gqgsklo.exe
2016	iaxichw.exe
2132	lgetszx.exe
4496	sloyjka.exe
4904	aajtnuf.exe
1480	xxitobk.exe
1244	dzzoezq.exe
1664	nroljps.exe
1732	tplbxqr.exe
1248	vkoesqy.exe
3124	dzcrvbd.exe
1696	fyoogad.exe
116	khwjwxj.exe
4908	aitzxgh.exe
1104	nzouggm.exe
956	vanuvvi.exe
1116	chiuhks.exe
3564	nzysmau.exe
3328	sxvizbt.exe
4316	pvciaig.exe
628	sftyteo.exe
856	uliiiwp.exe
4228	iyryoso.exe
3452	sqhdtqq.exe
3912	cptbdpx.exe
676	nlulljy.exe
3880	xgneaez.exe
1428	lqtgdvz.exe
2836	xszwpid.exe
3972	hrltzhl.exe
1076	vbrwcgl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gvoavjp.exe	wwcddkh.exe
File created	C:\Windows\SysWOW64\qzkaukd.exe	gdrimpu.exe
File opened for modification	C:\Windows\SysWOW64\ahcoctx.exe	vukywpy.exe
File created	C:\Windows\SysWOW64\himgspn.exe	wnlwkve.exe
File created	C:\Windows\SysWOW64\xgneaez.exe	nlulljy.exe
File created	C:\Windows\SysWOW64\hjshoik.exe	worwhoc.exe
File opened for modification	C:\Windows\SysWOW64\dilnlez.exe	pyfcifh.exe
File opened for modification	C:\Windows\SysWOW64\plvfita.exe	fpuutzz.exe
File opened for modification	C:\Windows\SysWOW64\prlmzdk.exe	ewkusij.exe
File created	C:\Windows\SysWOW64\gpwdwyh.exe	ypxdhjd.exe
File opened for modification	C:\Windows\SysWOW64\xsutkgm.exe	jqoihpm.exe
File opened for modification	C:\Windows\SysWOW64\gnaoafh.exe	vshwsly.exe
File created	C:\Windows\SysWOW64\nlulljy.exe	cptbdpx.exe
File opened for modification	C:\Windows\SysWOW64\pdxvscj.exe	fpwkdhi.exe
File opened for modification	C:\Windows\SysWOW64\jjfrhgv.exe	zkbuoho.exe
File created	C:\Windows\SysWOW64\dweinbq.exe	shzylpn.exe
File opened for modification	C:\Windows\SysWOW64\xgbhfcp.exe	nhpkvdh.exe
File opened for modification	C:\Windows\SysWOW64\qnskejc.exe	grrsppb.exe
File opened for modification	C:\Windows\SysWOW64\pnyhmqs.exe	hjocdfp.exe
File created	C:\Windows\SysWOW64\sawwvyx.exe	ltbwbjn.exe
File created	C:\Windows\SysWOW64\znbwlzh.exe	svcwfld.exe
File created	C:\Windows\SysWOW64\zmrtfyy.exe	prqixex.exe
File opened for modification	C:\Windows\SysWOW64\drbpyhc.exe	tsxroid.exe
File created	C:\Windows\SysWOW64\ywrnxrd.exe	syuxjye.exe
File opened for modification	C:\Windows\SysWOW64\vanuvvi.exe	nzouggm.exe
File opened for modification	C:\Windows\SysWOW64\cigcids.exe	sjcexek.exe
File opened for modification	C:\Windows\SysWOW64\ssgpkhy.exe	haqjxrf.exe
File created	C:\Windows\SysWOW64\sagshkr.exe	ibtvwlj.exe
File created	C:\Windows\SysWOW64\szcvjlh.exe	hhnxfvf.exe
File opened for modification	C:\Windows\SysWOW64\rrbxfvc.exe	eaguwux.exe
File opened for modification	C:\Windows\SysWOW64\szcvjlh.exe	hhnxfvf.exe
File opened for modification	C:\Windows\SysWOW64\ewkusij.exe	rjaemfd.exe
File opened for modification	C:\Windows\SysWOW64\acumnpz.exe	qzgclfh.exe
File created	C:\Windows\SysWOW64\yljoqyt.exe	qtkwjsp.exe
File opened for modification	C:\Windows\SysWOW64\ojgeevb.exe	eccgtwu.exe
File created	C:\Windows\SysWOW64\frrzegc.exe	sawwvyx.exe
File created	C:\Windows\SysWOW64\jkdysmu.exe	yvrgqtz.exe
File opened for modification	C:\Windows\SysWOW64\gcndsmh.exe	whmllry.exe
File opened for modification	C:\Windows\SysWOW64\vqwicre.exe	oiaqitd.exe
File created	C:\Windows\SysWOW64\kjefggx.exe	acahohp.exe
File opened for modification	C:\Windows\SysWOW64\cqatruv.exe	rvzbkau.exe
File opened for modification	C:\Windows\SysWOW64\refziko.exe	himgspn.exe
File created	C:\Windows\SysWOW64\ovsewde.exe	eoohlex.exe
File created	C:\Windows\SysWOW64\xnljlno.exe	kefgioo.exe
File opened for modification	C:\Windows\SysWOW64\varuasb.exe	leqksya.exe
File opened for modification	C:\Windows\SysWOW64\fsmaivx.exe	sxvkdrq.exe
File opened for modification	C:\Windows\SysWOW64\sdzldjt.exe	fqhvynu.exe
File created	C:\Windows\SysWOW64\hbyclwc.exe	zxnxclz.exe
File opened for modification	C:\Windows\SysWOW64\ozmhdyh.exe	becrxuj.exe
File opened for modification	C:\Windows\SysWOW64\sjcexek.exe	iobuikj.exe
File created	C:\Windows\SysWOW64\gcndsmh.exe	whmllry.exe
File opened for modification	C:\Windows\SysWOW64\bwbfbda.exe	zwxijeb.exe
File opened for modification	C:\Windows\SysWOW64\sarhufx.exe	iankkop.exe
File opened for modification	C:\Windows\SysWOW64\zmrtfyy.exe	prqixex.exe
File opened for modification	C:\Windows\SysWOW64\hcohbgd.exe	xgvwmlu.exe
File created	C:\Windows\SysWOW64\indidpo.exe	bitvmed.exe
File created	C:\Windows\SysWOW64\qzkipoc.exe	ivivgdz.exe
File created	C:\Windows\SysWOW64\vxudswc.exe	qlbvzvp.exe
File opened for modification	C:\Windows\SysWOW64\hnvdrbm.exe	xsutkgm.exe
File created	C:\Windows\SysWOW64\hfjqhri.exe	xgxkpsa.exe
File opened for modification	C:\Windows\SysWOW64\hkrwyxn.exe	wpqmrcn.exe
File created	C:\Windows\SysWOW64\uiskudb.exe	jbonceb.exe
File created	C:\Windows\SysWOW64\uliiiwp.exe	sftyteo.exe
File opened for modification	C:\Windows\SysWOW64\keakjnb.exe	zizacka.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfrtkwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhgfadl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vinzmgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ahcoctx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyfcifh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xgxkpsa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oxifdtb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpftyqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uttklwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdinhos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phtlmiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qwatqrc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdxvscj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vvecmnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nrfauwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esiizbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wbvdqyu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dihfqcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vxmkowx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ylerpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jbflgzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntcffdu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpwdwyh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	naxpwxx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exlyysu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kcfhnlc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kwxshlz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jezxqle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsuzkon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	laypaas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	teklnjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nbqspaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vanuvvi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcwsqri.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keakjnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ovsewde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ondnzbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crzjdet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgllhnq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memhyqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byjdzix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hnuqkxq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcotctg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rnkmbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gahaaxb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gnaoafh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qyvzulc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iyryoso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cigcids.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kdgryzl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfqipvb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iaxichw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	znbwlzh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vktxivn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxvizbt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elmczpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flpakln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xomtcnw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wjdjifn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tftfifi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jxwzgnu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kgotvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elydgkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jqoihpm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	pofkqpy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hhfoIxTe = "b\|jj@f}efEuCh_xBN"	bzugykc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "wRgvUCeB~DGsiYg^RAEPNTNHr{m"	japqaqq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govLHTq{fRDAVD\x7f"	gscdojo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "gRwvUCeAnDWsiYg^RAEPNTNHr{m"	csvytat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "URwvUCeB\\DWsiYg^RAEPNTNHr{m"	wqwtsve.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govyHLq{fRbbksS"	hvkbcuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "\|RwvUCeCuDWsiYg^RAEPNTNHr{m"	lpbssfs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "rRgvUCeA{DGsiYg^RAEPNTNHr{m"	ragaknq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\QKeMwmSnisjAb = "\x7f\\PjxwnDM~b\\eVwQvtRB\|"	egjlbyl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "XRWvUCe@QDwsiYg^RAEPNTNHr{m"	lrxpexq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\PGOffmLkjj = "CQ\x7fx~JnlJNtSEG_AM]GrSdi"	oalmcpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hhfoIxTe = "b\|jj@f}efEuCh_xBN"	chiuhks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	cqatruv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govPXPq{fQdh[Cb"	uylanza.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govjhHq{fQKbj{Q"	vkoesqy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "DRgvUCeBMDGsiYg^RAEPNTNHr{m"	uiskudb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vwkbmv = "[CoT`p]kfTHtaDhvVO}Fj`"	jhgfadl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	tewoelm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	ozmhdyh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vwkbmv = "[CoT`p]kfTHtaDhvVO}Fjb"	cptbdpx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\PGOffmLkjj = "CQ\x7fx~JnlJNtSEG_AM]GrSdi"	bznapil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	xeadhse.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "`RwvUCeAiDWsiYg^RAEPNTNHr{m"	kajqgpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govHXTq{fPXHOlj"	tfwrzhv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "`RWvUCe@iDwsiYg^RAEPNTNHr{m"	vjovbks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\kbzn = "\|pims{raNfKIiL\\rkrfh[cHyAc]"	wjsvond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\PGOffmLkjj = "CQ\x7fx~JnlJNtSEG_AM]GrSdi"	kevntun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govDxTq{fRmPAR["	jbjuqnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	ljqiccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hhfoIxTe = "b\|jj@f}efEuCh_xBN"	tymmoqz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\PGOffmLkjj = "CQ\x7fx~JnlJNtSEG_AM]GrSdi"	xgxkpsa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	fbxrwrc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "RRgvUCe@[DGsiYg^RAEPNTNHr{m"	dbmaans.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "PRgvUCe@YDGsiYg^RAEPNTNHr{m"	vxmkowx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "cRgvUCeBjDGsiYg^RAEPNTNHr{m"	mqzaegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govixHq{fPM[zk{"	dzcrvbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "iRwvUCeA`DWsiYg^RAEPNTNHr{m"	evzjxcq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "NRwvUCeBGDWsiYg^RAEPNTNHr{m"	uqwvjpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\QKeMwmSnisjAb = "\x7f\\PjxwnDM~b\\eVwQvtRB\|"	hjshoik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\kbzn = "\|pims{raNfKIiL\\rkrfh[cHyAc]"	ojlirkt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\PGOffmLkjj = "CQ\x7fx~JnlJNtSEG_AM]GrSdi"	bcwsqri.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "dRwvUCe@mDWsiYg^RAEPNTNHr{m"	aajtnuf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	kefgioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govGXLq{fSTXMIV"	vbrwcgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "DRWvUCe@MDwsiYg^RAEPNTNHr{m"	iurpvrq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "gov\x7fHHq{fS\\_jir"	iyryoso.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hhfoIxTe = "b\|jj@f}efEuCh_xBN"	zjkdtmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\QKeMwmSnisjAb = "\x7f\\PjxwnDM~b\\eVwQvtRB\|"	lefzten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	uhxorzm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "VRwvUCe@_DWsiYg^RAEPNTNHr{m"	iveqtxi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\nIzFZPGtyhad = "O\|\x7fAkm]OIHUtptEN"	gjddrvj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "FRgvUCeAODGsiYg^RAEPNTNHr{m"	hfqipvb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hhfoIxTe = "b\|jj@f}efEuCh_xBN"	lvccsbw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\kbzn = "\|pims{raNfKIiL\\rkrfh[cHyAc]"	qpxuwxi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "fRgvUCeAoDGsiYg^RAEPNTNHr{m"	ksbbfnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\PGOffmLkjj = "CQ\x7fx~JnlJNtSEG_AM]GrSdi"	lpbssfs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "gov{h\\q{fS]RiOq"	mwgrhva.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\kbzn = "\|pims{raNfKIiL\\rkrfh[cHyAc]"	cvwpmpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\PGOffmLkjj = "CQ\x7fx~JnlJNtSEG_AM]GrSdi"	vktxivn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vwkbmv = "[CoT`p]kfTHtaDhvVO}Fjb"	qzkaukd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govjxDq{fRobGay"	bafggkt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\hwhvrkc = "uRgvUCeC\|DGsiYg^RAEPNTNHr{m"	ahtsqhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6B4EC4B-1154-B58E-1154-B58E1154B58E}\vySOgzgj = "govex@q{fRp`_Yb"	wbtaceo.exe

NTFS ADS 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\TEMP:3DAA471A	mubmwox.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	yphsdek.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	nzouggm.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	rndfazj.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	ynglkqs.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	ajgdgky.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	kbraxpk.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	cvwpmpq.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	lufwcwg.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	wqdmawf.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	vnksjbi.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	sloofoh.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	fwhtwcf.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	gnaoafh.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	oxifdtb.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	bhupgdb.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	exlyysu.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	htyuqad.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	lyypydi.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	aazvuuy.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	cjvdhct.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	dwairzb.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	byjndmq.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	rrbcfje.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	dqlkddb.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	dcgertj.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	xgvwmlu.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	hfjqhri.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	xnljlno.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	mzwaiam.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	cxeattq.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	vfafzmg.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	zizacka.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	fsiaexe.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	oehceoz.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	xgxkpsa.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	glmqeaz.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	eoohlex.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	eeokihp.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	bitvmed.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	ynlewhm.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	yzyeoxp.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	qzkipoc.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	fcjuvlp.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	xjeprvq.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	kefgioo.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	qzkaukd.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	wemrctl.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	yzhlyiq.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	sagshkr.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	ojlirkt.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	jbflgzu.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	jdzxrmr.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	cwkonyf.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	csvytat.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	gfsnvim.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	indidpo.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	tftfifi.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	itjoagm.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	mwgrhva.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	wnfaumr.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	xaenfut.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	zjkdtmf.exe
File opened for modification	C:\ProgramData\TEMP:3DAA471A	nqzgbwq.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3944	f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3944	f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe
Token: 33	3968	gykhptx.exe
Token: SeIncBasePriorityPrivilege	3968	gykhptx.exe
Token: 33	2776	jezxqle.exe
Token: SeIncBasePriorityPrivilege	2776	jezxqle.exe
Token: 33	4684	tmfzurj.exe
Token: SeIncBasePriorityPrivilege	4684	tmfzurj.exe
Token: 33	1392	tepxadq.exe
Token: SeIncBasePriorityPrivilege	1392	tepxadq.exe
Token: 33	3324	bmldgbx.exe
Token: SeIncBasePriorityPrivilege	3324	bmldgbx.exe
Token: 33	756	tilnckc.exe
Token: SeIncBasePriorityPrivilege	756	tilnckc.exe
Token: 33	1372	ozfqrzl.exe
Token: SeIncBasePriorityPrivilege	1372	ozfqrzl.exe
Token: 33	3992	lladpts.exe
Token: SeIncBasePriorityPrivilege	3992	lladpts.exe
Token: 33	3696	gzrbcmu.exe
Token: SeIncBasePriorityPrivilege	3696	gzrbcmu.exe
Token: 33	4788	qyvzulc.exe
Token: SeIncBasePriorityPrivilege	4788	qyvzulc.exe
Token: 33	1956	qnteltf.exe
Token: SeIncBasePriorityPrivilege	1956	qnteltf.exe
Token: 33	4264	inwckzr.exe
Token: SeIncBasePriorityPrivilege	4264	inwckzr.exe
Token: 33	968	qzgclfh.exe
Token: SeIncBasePriorityPrivilege	968	qzgclfh.exe
Token: 33	5108	acumnpz.exe
Token: SeIncBasePriorityPrivilege	5108	acumnpz.exe
Token: 33	1464	naxpwxx.exe
Token: SeIncBasePriorityPrivilege	1464	naxpwxx.exe
Token: 33	3004	syuxjye.exe
Token: SeIncBasePriorityPrivilege	3004	syuxjye.exe
Token: 33	3816	ywrnxrd.exe
Token: SeIncBasePriorityPrivilege	3816	ywrnxrd.exe
Token: 33	3276	vuynqyi.exe
Token: SeIncBasePriorityPrivilege	3276	vuynqyi.exe
Token: 33	228	iveqtxi.exe
Token: SeIncBasePriorityPrivilege	228	iveqtxi.exe
Token: 33	452	sguagbo.exe
Token: SeIncBasePriorityPrivilege	452	sguagbo.exe
Token: 33	4544	ftlqmev.exe
Token: SeIncBasePriorityPrivilege	4544	ftlqmev.exe
Token: 33	2956	qlbvzvp.exe
Token: SeIncBasePriorityPrivilege	2956	qlbvzvp.exe
Token: 33	3376	ftnoard.exe
Token: SeIncBasePriorityPrivilege	3376	ftnoard.exe
Token: 33	4780	nmuoggh.exe
Token: SeIncBasePriorityPrivilege	4780	nmuoggh.exe
Token: 33	2316	lufwcwg.exe
Token: SeIncBasePriorityPrivilege	2316	lufwcwg.exe
Token: 33	704	nmwmuso.exe
Token: SeIncBasePriorityPrivilege	704	nmwmuso.exe
Token: 33	4396	qtkwjsp.exe
Token: SeIncBasePriorityPrivilege	4396	qtkwjsp.exe
Token: 33	2456	yljoqyt.exe
Token: SeIncBasePriorityPrivilege	2456	yljoqyt.exe
Token: 33	4012	dgdrbvt.exe
Token: SeIncBasePriorityPrivilege	4012	dgdrbvt.exe
Token: 33	312	fbguwva.exe
Token: SeIncBasePriorityPrivilege	312	fbguwva.exe
Token: 33	3832	ihmflnj.exe
Token: SeIncBasePriorityPrivilege	3832	ihmflnj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3968	3944	f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe	82
PID 3944 wrote to memory of 3968	3944	f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe	82
PID 3944 wrote to memory of 3968	3944	f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe	82
PID 3968 wrote to memory of 2776	3968	gykhptx.exe	83
PID 3968 wrote to memory of 2776	3968	gykhptx.exe	83
PID 3968 wrote to memory of 2776	3968	gykhptx.exe	83
PID 2776 wrote to memory of 4684	2776	jezxqle.exe	84
PID 2776 wrote to memory of 4684	2776	jezxqle.exe	84
PID 2776 wrote to memory of 4684	2776	jezxqle.exe	84
PID 4684 wrote to memory of 1392	4684	tmfzurj.exe	85
PID 4684 wrote to memory of 1392	4684	tmfzurj.exe	85
PID 4684 wrote to memory of 1392	4684	tmfzurj.exe	85
PID 1392 wrote to memory of 3324	1392	tepxadq.exe	86
PID 1392 wrote to memory of 3324	1392	tepxadq.exe	86
PID 1392 wrote to memory of 3324	1392	tepxadq.exe	86
PID 3324 wrote to memory of 756	3324	bmldgbx.exe	87
PID 3324 wrote to memory of 756	3324	bmldgbx.exe	87
PID 3324 wrote to memory of 756	3324	bmldgbx.exe	87
PID 756 wrote to memory of 1372	756	tilnckc.exe	88
PID 756 wrote to memory of 1372	756	tilnckc.exe	88
PID 756 wrote to memory of 1372	756	tilnckc.exe	88
PID 1372 wrote to memory of 3992	1372	ozfqrzl.exe	89
PID 1372 wrote to memory of 3992	1372	ozfqrzl.exe	89
PID 1372 wrote to memory of 3992	1372	ozfqrzl.exe	89
PID 3992 wrote to memory of 3696	3992	lladpts.exe	90
PID 3992 wrote to memory of 3696	3992	lladpts.exe	90
PID 3992 wrote to memory of 3696	3992	lladpts.exe	90
PID 3696 wrote to memory of 4788	3696	gzrbcmu.exe	91
PID 3696 wrote to memory of 4788	3696	gzrbcmu.exe	91
PID 3696 wrote to memory of 4788	3696	gzrbcmu.exe	91
PID 4788 wrote to memory of 1956	4788	qyvzulc.exe	92
PID 4788 wrote to memory of 1956	4788	qyvzulc.exe	92
PID 4788 wrote to memory of 1956	4788	qyvzulc.exe	92
PID 1956 wrote to memory of 4264	1956	qnteltf.exe	93
PID 1956 wrote to memory of 4264	1956	qnteltf.exe	93
PID 1956 wrote to memory of 4264	1956	qnteltf.exe	93
PID 4264 wrote to memory of 968	4264	inwckzr.exe	94
PID 4264 wrote to memory of 968	4264	inwckzr.exe	94
PID 4264 wrote to memory of 968	4264	inwckzr.exe	94
PID 968 wrote to memory of 5108	968	qzgclfh.exe	95
PID 968 wrote to memory of 5108	968	qzgclfh.exe	95
PID 968 wrote to memory of 5108	968	qzgclfh.exe	95
PID 5108 wrote to memory of 1464	5108	acumnpz.exe	96
PID 5108 wrote to memory of 1464	5108	acumnpz.exe	96
PID 5108 wrote to memory of 1464	5108	acumnpz.exe	96
PID 1464 wrote to memory of 3004	1464	naxpwxx.exe	99
PID 1464 wrote to memory of 3004	1464	naxpwxx.exe	99
PID 1464 wrote to memory of 3004	1464	naxpwxx.exe	99
PID 3004 wrote to memory of 3816	3004	syuxjye.exe	100
PID 3004 wrote to memory of 3816	3004	syuxjye.exe	100
PID 3004 wrote to memory of 3816	3004	syuxjye.exe	100
PID 3816 wrote to memory of 3276	3816	ywrnxrd.exe	101
PID 3816 wrote to memory of 3276	3816	ywrnxrd.exe	101
PID 3816 wrote to memory of 3276	3816	ywrnxrd.exe	101
PID 3276 wrote to memory of 228	3276	vuynqyi.exe	103
PID 3276 wrote to memory of 228	3276	vuynqyi.exe	103
PID 3276 wrote to memory of 228	3276	vuynqyi.exe	103
PID 228 wrote to memory of 452	228	iveqtxi.exe	105
PID 228 wrote to memory of 452	228	iveqtxi.exe	105
PID 228 wrote to memory of 452	228	iveqtxi.exe	105
PID 452 wrote to memory of 4544	452	sguagbo.exe	106
PID 452 wrote to memory of 4544	452	sguagbo.exe	106
PID 452 wrote to memory of 4544	452	sguagbo.exe	106
PID 4544 wrote to memory of 2956	4544	ftlqmev.exe	107

C:\Users\Admin\AppData\Local\Temp\f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\gykhptx.exe
  C:\Windows\system32\gykhptx.exe 1296 "C:\Users\Admin\AppData\Local\Temp\f7a1a4ec8ee1f0504378264b77c200cf_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\jezxqle.exe
    C:\Windows\system32\jezxqle.exe 1376 "C:\Windows\SysWOW64\gykhptx.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\tmfzurj.exe
      C:\Windows\system32\tmfzurj.exe 1284 "C:\Windows\SysWOW64\jezxqle.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Windows\SysWOW64\tepxadq.exe
        
        C:\Windows\system32\tepxadq.exe 1428 "C:\Windows\SysWOW64\tmfzurj.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1392
      - C:\Windows\SysWOW64\bmldgbx.exe
        
        C:\Windows\system32\bmldgbx.exe 1288 "C:\Windows\SysWOW64\tepxadq.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\tilnckc.exe
        
        C:\Windows\system32\tilnckc.exe 1316 "C:\Windows\SysWOW64\bmldgbx.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\ozfqrzl.exe
        
        C:\Windows\system32\ozfqrzl.exe 1324 "C:\Windows\SysWOW64\tilnckc.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\lladpts.exe
        
        C:\Windows\system32\lladpts.exe 1444 "C:\Windows\SysWOW64\ozfqrzl.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\gzrbcmu.exe
        
        C:\Windows\system32\gzrbcmu.exe 1440 "C:\Windows\SysWOW64\lladpts.exe"
        10⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\qyvzulc.exe
        
        C:\Windows\system32\qyvzulc.exe 1304 "C:\Windows\SysWOW64\gzrbcmu.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\qnteltf.exe
        
        C:\Windows\system32\qnteltf.exe 1464 "C:\Windows\SysWOW64\qyvzulc.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\inwckzr.exe
        
        C:\Windows\system32\inwckzr.exe 1456 "C:\Windows\SysWOW64\qnteltf.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\qzgclfh.exe
        
        C:\Windows\system32\qzgclfh.exe 1292 "C:\Windows\SysWOW64\inwckzr.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\acumnpz.exe
        
        C:\Windows\system32\acumnpz.exe 1280 "C:\Windows\SysWOW64\qzgclfh.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\naxpwxx.exe
        
        C:\Windows\system32\naxpwxx.exe 1380 "C:\Windows\SysWOW64\acumnpz.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\syuxjye.exe
        
        C:\Windows\system32\syuxjye.exe 1300 "C:\Windows\SysWOW64\naxpwxx.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\ywrnxrd.exe
        
        C:\Windows\system32\ywrnxrd.exe 1452 "C:\Windows\SysWOW64\syuxjye.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\vuynqyi.exe
        
        C:\Windows\system32\vuynqyi.exe 1308 "C:\Windows\SysWOW64\ywrnxrd.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\iveqtxi.exe
        
        C:\Windows\system32\iveqtxi.exe 1484 "C:\Windows\SysWOW64\vuynqyi.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\sguagbo.exe
        
        C:\Windows\system32\sguagbo.exe 1332 "C:\Windows\SysWOW64\iveqtxi.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\ftlqmev.exe
        
        C:\Windows\system32\ftlqmev.exe 1356 "C:\Windows\SysWOW64\sguagbo.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\qlbvzvp.exe
        
        C:\Windows\system32\qlbvzvp.exe 1348 "C:\Windows\SysWOW64\ftlqmev.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
        
        C:\Windows\SysWOW64\vxudswc.exe
        
        C:\Windows\system32\vxudswc.exe 1500 "C:\Windows\SysWOW64\qlbvzvp.exe"
        24⤵
        Executes dropped EXE
        
        PID:760
        
        C:\Windows\SysWOW64\ftnoard.exe
        
        C:\Windows\system32\ftnoard.exe 1496 "C:\Windows\SysWOW64\vxudswc.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
        
        C:\Windows\SysWOW64\nmuoggh.exe
        
        C:\Windows\system32\nmuoggh.exe 1360 "C:\Windows\SysWOW64\ftnoard.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
        
        C:\Windows\SysWOW64\lufwcwg.exe
        
        C:\Windows\system32\lufwcwg.exe 1352 "C:\Windows\SysWOW64\nmuoggh.exe"
        27⤵
        Checks BIOS information in registry
        Executes dropped EXE
        NTFS ADS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\SysWOW64\nmwmuso.exe
        
        C:\Windows\system32\nmwmuso.exe 1516 "C:\Windows\SysWOW64\lufwcwg.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:704
        
        C:\Windows\SysWOW64\qtkwjsp.exe
        
        C:\Windows\system32\qtkwjsp.exe 1312 "C:\Windows\SysWOW64\nmwmuso.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4396
        
        C:\Windows\SysWOW64\yljoqyt.exe
        
        C:\Windows\system32\yljoqyt.exe 1372 "C:\Windows\SysWOW64\qtkwjsp.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\SysWOW64\dgdrbvt.exe
        
        C:\Windows\system32\dgdrbvt.exe 1532 "C:\Windows\SysWOW64\yljoqyt.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4012
        
        C:\Windows\SysWOW64\fbguwva.exe
        
        C:\Windows\system32\fbguwva.exe 1344 "C:\Windows\SysWOW64\dgdrbvt.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:312
        
        C:\Windows\SysWOW64\ihmflnj.exe
        
        C:\Windows\system32\ihmflnj.exe 1528 "C:\Windows\SysWOW64\fbguwva.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3832
        
        C:\Windows\SysWOW64\sdnptik.exe
        
        C:\Windows\system32\sdnptik.exe 1540 "C:\Windows\SysWOW64\ihmflnj.exe"
        34⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\yphsdek.exe
        
        C:\Windows\system32\yphsdek.exe 1340 "C:\Windows\SysWOW64\sdnptik.exe"
        35⤵
        Executes dropped EXE
        NTFS ADS
        
        PID:3568
        
        C:\Windows\SysWOW64\gqgsklo.exe
        
        C:\Windows\system32\gqgsklo.exe 1328 "C:\Windows\SysWOW64\yphsdek.exe"
        36⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\iaxichw.exe
        
        C:\Windows\system32\iaxichw.exe 1392 "C:\Windows\SysWOW64\gqgsklo.exe"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Windows\SysWOW64\lgetszx.exe
        
        C:\Windows\system32\lgetszx.exe 1336 "C:\Windows\SysWOW64\iaxichw.exe"
        38⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\sloyjka.exe
        
        C:\Windows\system32\sloyjka.exe 1400 "C:\Windows\SysWOW64\lgetszx.exe"
        39⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\aajtnuf.exe
        
        C:\Windows\system32\aajtnuf.exe 1408 "C:\Windows\SysWOW64\sloyjka.exe"
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\xxitobk.exe
        
        C:\Windows\system32\xxitobk.exe 1564 "C:\Windows\SysWOW64\aajtnuf.exe"
        41⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\dzzoezq.exe
        
        C:\Windows\system32\dzzoezq.exe 1412 "C:\Windows\SysWOW64\xxitobk.exe"
        42⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\nroljps.exe
        
        C:\Windows\system32\nroljps.exe 1580 "C:\Windows\SysWOW64\dzzoezq.exe"
        43⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\tplbxqr.exe
        
        C:\Windows\system32\tplbxqr.exe 1388 "C:\Windows\SysWOW64\nroljps.exe"
        44⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\vkoesqy.exe
        
        C:\Windows\system32\vkoesqy.exe 1588 "C:\Windows\SysWOW64\tplbxqr.exe"
        45⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Modifies registry class
        
        PID:1248
        
        C:\Windows\SysWOW64\dzcrvbd.exe
        
        C:\Windows\system32\dzcrvbd.exe 1420 "C:\Windows\SysWOW64\vkoesqy.exe"
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\fyoogad.exe
        
        C:\Windows\system32\fyoogad.exe 1584 "C:\Windows\SysWOW64\dzcrvbd.exe"
        47⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\khwjwxj.exe
        
        C:\Windows\system32\khwjwxj.exe 1424 "C:\Windows\SysWOW64\fyoogad.exe"
        48⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\aitzxgh.exe
        
        C:\Windows\system32\aitzxgh.exe 1320 "C:\Windows\SysWOW64\khwjwxj.exe"
        49⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\nzouggm.exe
        
        C:\Windows\system32\nzouggm.exe 1436 "C:\Windows\SysWOW64\aitzxgh.exe"
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        NTFS ADS
        
        PID:1104
        
        C:\Windows\SysWOW64\vanuvvi.exe
        
        C:\Windows\system32\vanuvvi.exe 1460 "C:\Windows\SysWOW64\nzouggm.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:956
        
        C:\Windows\SysWOW64\chiuhks.exe
        
        C:\Windows\system32\chiuhks.exe 1404 "C:\Windows\SysWOW64\vanuvvi.exe"
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\nzysmau.exe
        
        C:\Windows\system32\nzysmau.exe 1612 "C:\Windows\SysWOW64\chiuhks.exe"
        53⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\sxvizbt.exe
        
        C:\Windows\system32\sxvizbt.exe 1620 "C:\Windows\SysWOW64\nzysmau.exe"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Windows\SysWOW64\pvciaig.exe
        
        C:\Windows\system32\pvciaig.exe 1616 "C:\Windows\SysWOW64\sxvizbt.exe"
        55⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\sftyteo.exe
        
        C:\Windows\system32\sftyteo.exe 1636 "C:\Windows\SysWOW64\pvciaig.exe"
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:628
        
        C:\Windows\SysWOW64\uliiiwp.exe
        
        C:\Windows\system32\uliiiwp.exe 1448 "C:\Windows\SysWOW64\sftyteo.exe"
        57⤵
        Executes dropped EXE
        
        PID:856
        
        C:\Windows\SysWOW64\iyryoso.exe
        
        C:\Windows\system32\iyryoso.exe 1468 "C:\Windows\SysWOW64\uliiiwp.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\sqhdtqq.exe
        
        C:\Windows\system32\sqhdtqq.exe 1268 "C:\Windows\SysWOW64\iyryoso.exe"
        59⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\cptbdpx.exe
        
        C:\Windows\system32\cptbdpx.exe 1384 "C:\Windows\SysWOW64\sqhdtqq.exe"
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3912
        
        C:\Windows\SysWOW64\nlulljy.exe
        
        C:\Windows\system32\nlulljy.exe 1368 "C:\Windows\SysWOW64\cptbdpx.exe"
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:676
        
        C:\Windows\SysWOW64\xgneaez.exe
        
        C:\Windows\system32\xgneaez.exe 1416 "C:\Windows\SysWOW64\nlulljy.exe"
        62⤵
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\SysWOW64\lqtgdvz.exe
        
        C:\Windows\system32\lqtgdvz.exe 1492 "C:\Windows\SysWOW64\xgneaez.exe"
        63⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:1428
        
        C:\Windows\SysWOW64\xszwpid.exe
        
        C:\Windows\system32\xszwpid.exe 1508 "C:\Windows\SysWOW64\lqtgdvz.exe"
        64⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\hrltzhl.exe
        
        C:\Windows\system32\hrltzhl.exe 1668 "C:\Windows\SysWOW64\xszwpid.exe"
        65⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\vbrwcgl.exe
        
        C:\Windows\system32\vbrwcgl.exe 1512 "C:\Windows\SysWOW64\hrltzhl.exe"
        66⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\iobuikj.exe
        
        C:\Windows\system32\iobuikj.exe 1664 "C:\Windows\SysWOW64\vbrwcgl.exe"
        67⤵
        Drops file in System32 directory
        
        PID:3536
        
        C:\Windows\SysWOW64\sjcexek.exe
        
        C:\Windows\system32\sjcexek.exe 1480 "C:\Windows\SysWOW64\iobuikj.exe"
        68⤵
        Drops file in System32 directory
        
        PID:1408
        
        C:\Windows\SysWOW64\cigcids.exe
        
        C:\Windows\system32\cigcids.exe 1396 "C:\Windows\SysWOW64\sjcexek.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\qvxrozq.exe
        
        C:\Windows\system32\qvxrozq.exe 1536 "C:\Windows\SysWOW64\cigcids.exe"
        70⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\accpyyy.exe
        
        C:\Windows\system32\accpyyy.exe 1488 "C:\Windows\SysWOW64\qvxrozq.exe"
        71⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\kbouqxf.exe
        
        C:\Windows\system32\kbouqxf.exe 1472 "C:\Windows\SysWOW64\accpyyy.exe"
        72⤵
        
        PID:692
        
        C:\Windows\SysWOW64\vudsvnz.exe
        
        C:\Windows\system32\vudsvnz.exe 1692 "C:\Windows\SysWOW64\kbouqxf.exe"
        73⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\fpwkdhi.exe
        
        C:\Windows\system32\fpwkdhi.exe 1700 "C:\Windows\SysWOW64\vudsvnz.exe"
        74⤵
        Drops file in System32 directory
        
        PID:3336
        
        C:\Windows\SysWOW64\pdxvscj.exe
        
        C:\Windows\system32\pdxvscj.exe 1432 "C:\Windows\SysWOW64\fpwkdhi.exe"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Windows\SysWOW64\ayynawk.exe
        
        C:\Windows\system32\ayynawk.exe 1708 "C:\Windows\SysWOW64\pdxvscj.exe"
        76⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\hdisrpm.exe
        
        C:\Windows\system32\hdisrpm.exe 1476 "C:\Windows\SysWOW64\ayynawk.exe"
        77⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\syblzkv.exe
        
        C:\Windows\system32\syblzkv.exe 1764 "C:\Windows\SysWOW64\hdisrpm.exe"
        78⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\cucvhew.exe
        
        C:\Windows\system32\cucvhew.exe 1576 "C:\Windows\SysWOW64\syblzkv.exe"
        79⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\phtlmiv.exe
        
        C:\Windows\system32\phtlmiv.exe 1560 "C:\Windows\SysWOW64\cucvhew.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\cfonvia.exe
        
        C:\Windows\system32\cfonvia.exe 1504 "C:\Windows\SysWOW64\phtlmiv.exe"
        81⤵
        Checks BIOS information in registry
        
        PID:1780
        
        C:\Windows\SysWOW64\qpuyyis.exe
        
        C:\Windows\system32\qpuyyis.exe 1524 "C:\Windows\SysWOW64\cfonvia.exe"
        82⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\xwiqsxc.exe
        
        C:\Windows\system32\xwiqsxc.exe 1728 "C:\Windows\SysWOW64\qpuyyis.exe"
        83⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\kgotvxc.exe
        
        C:\Windows\system32\kgotvxc.exe 1592 "C:\Windows\SysWOW64\xwiqsxc.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\vfaygwj.exe
        
        C:\Windows\system32\vfaygwj.exe 1552 "C:\Windows\SysWOW64\kgotvxc.exe"
        85⤵
        
        PID:800
        
        C:\Windows\SysWOW64\xxqwsmd.exe
        
        C:\Windows\system32\xxqwsmd.exe 1600 "C:\Windows\SysWOW64\vfaygwj.exe"
        86⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\itjoagm.exe
        
        C:\Windows\system32\itjoagm.exe 1596 "C:\Windows\SysWOW64\xxqwsmd.exe"
        87⤵
        NTFS ADS
        
        PID:1880
        
        C:\Windows\SysWOW64\ssvmkfu.exe
        
        C:\Windows\system32\ssvmkfu.exe 1752 "C:\Windows\SysWOW64\itjoagm.exe"
        88⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\crzjdet.exe
        
        C:\Windows\system32\crzjdet.exe 1220 "C:\Windows\SysWOW64\ssvmkfu.exe"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\mmaukyc.exe
        
        C:\Windows\system32\mmaukyc.exe 1548 "C:\Windows\SysWOW64\crzjdet.exe"
        90⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\awgenyu.exe
        
        C:\Windows\system32\awgenyu.exe 1772 "C:\Windows\SysWOW64\mmaukyc.exe"
        91⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\haqjxrf.exe
        
        C:\Windows\system32\haqjxrf.exe 1632 "C:\Windows\SysWOW64\awgenyu.exe"
        92⤵
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\ssgpkhy.exe
        
        C:\Windows\system32\ssgpkhy.exe 1572 "C:\Windows\SysWOW64\haqjxrf.exe"
        93⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\fmmfvll.exe
        
        C:\Windows\system32\fmmfvll.exe 1640 "C:\Windows\SysWOW64\ssgpkhy.exe"
        94⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\mqwkffo.exe
        
        C:\Windows\system32\mqwkffo.exe 1604 "C:\Windows\SysWOW64\fmmfvll.exe"
        95⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\xjeprvq.exe
        
        C:\Windows\system32\xjeprvq.exe 1556 "C:\Windows\SysWOW64\mqwkffo.exe"
        96⤵
        NTFS ADS
        
        PID:2020
        
        C:\Windows\SysWOW64\ibtvwlj.exe
        
        C:\Windows\system32\ibtvwlj.exe 1624 "C:\Windows\SysWOW64\xjeprvq.exe"
        97⤵
        Drops file in System32 directory
        
        PID:1420
        
        C:\Windows\SysWOW64\sagshkr.exe
        
        C:\Windows\system32\sagshkr.exe 1660 "C:\Windows\SysWOW64\ibtvwlj.exe"
        98⤵
        Checks BIOS information in registry
        NTFS ADS
        
        PID:3348
        
        C:\Windows\SysWOW64\csvytat.exe
        
        C:\Windows\system32\csvytat.exe 1652 "C:\Windows\SysWOW64\sagshkr.exe"
        99⤵
        Modifies registry class
        NTFS ADS
        
        PID:3916
        
        C:\Windows\SysWOW64\kajqgpd.exe
        
        C:\Windows\system32\kajqgpd.exe 1812 "C:\Windows\SysWOW64\csvytat.exe"
        100⤵
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\xjpsjpu.exe
        
        C:\Windows\system32\xjpsjpu.exe 1656 "C:\Windows\SysWOW64\kajqgpd.exe"
        101⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\hibytnc.exe
        
        C:\Windows\system32\hibytnc.exe 1644 "C:\Windows\SysWOW64\xjpsjpu.exe"
        102⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\sarvgee.exe
        
        C:\Windows\system32\sarvgee.exe 1684 "C:\Windows\SysWOW64\hibytnc.exe"
        103⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\cwkonyf.exe
        
        C:\Windows\system32\cwkonyf.exe 1824 "C:\Windows\SysWOW64\sarvgee.exe"
        104⤵
        Checks BIOS information in registry
        NTFS ADS
        
        PID:3100
        
        C:\Windows\SysWOW64\kefgioo.exe
        
        C:\Windows\system32\kefgioo.exe 1676 "C:\Windows\SysWOW64\cwkonyf.exe"
        105⤵
        Drops file in System32 directory
        Modifies registry class
        NTFS ADS
        
        PID:4020
        
        C:\Windows\SysWOW64\xnljlno.exe
        
        C:\Windows\system32\xnljlno.exe 1688 "C:\Windows\SysWOW64\kefgioo.exe"
        106⤵
        NTFS ADS
        
        PID:4276
        
        C:\Windows\SysWOW64\evzjxcq.exe
        
        C:\Windows\system32\evzjxcq.exe 1836 "C:\Windows\SysWOW64\xnljlno.exe"
        107⤵
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\pnogkbs.exe
        
        C:\Windows\system32\pnogkbs.exe 1696 "C:\Windows\SysWOW64\evzjxcq.exe"
        108⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\aipzrvs.exe
        
        C:\Windows\system32\aipzrvs.exe 1680 "C:\Windows\SysWOW64\pnogkbs.exe"
        109⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\nvhoxrz.exe
        
        C:\Windows\system32\nvhoxrz.exe 1712 "C:\Windows\SysWOW64\aipzrvs.exe"
        110⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\udugjob.exe
        
        C:\Windows\system32\udugjob.exe 1704 "C:\Windows\SysWOW64\nvhoxrz.exe"
        111⤵
        Checks BIOS information in registry
        
        PID:2172
        
        C:\Windows\SysWOW64\fvkmwed.exe
        
        C:\Windows\system32\fvkmwed.exe 1720 "C:\Windows\SysWOW64\udugjob.exe"
        112⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\prleezd.exe
        
        C:\Windows\system32\prleezd.exe 1864 "C:\Windows\SysWOW64\fvkmwed.exe"
        113⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\zmmpltm.exe
        
        C:\Windows\system32\zmmpltm.exe 1568 "C:\Windows\SysWOW64\prleezd.exe"
        114⤵
        Checks BIOS information in registry
        
        PID:4600
        
        C:\Windows\SysWOW64\hjocdfp.exe
        
        C:\Windows\system32\hjocdfp.exe 1724 "C:\Windows\SysWOW64\zmmpltm.exe"
        115⤵
        Drops file in System32 directory
        
        PID:2052
        
        C:\Windows\SysWOW64\pnyhmqs.exe
        
        C:\Windows\system32\pnyhmqs.exe 1736 "C:\Windows\SysWOW64\hjocdfp.exe"
        116⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\zizacka.exe
        
        C:\Windows\system32\zizacka.exe 1544 "C:\Windows\SysWOW64\pnyhmqs.exe"
        117⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        NTFS ADS
        
        PID:3852
        
        C:\Windows\SysWOW64\keakjnb.exe
        
        C:\Windows\system32\keakjnb.exe 1716 "C:\Windows\SysWOW64\zizacka.exe"
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Windows\SysWOW64\uasurhc.exe
        
        C:\Windows\system32\uasurhc.exe 1744 "C:\Windows\SysWOW64\keakjnb.exe"
        119⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\fsiaexe.exe
        
        C:\Windows\system32\fsiaexe.exe 1756 "C:\Windows\SysWOW64\uasurhc.exe"
        120⤵
        NTFS ADS
        
        PID:1760
        
        C:\Windows\SysWOW64\pruxowl.exe
        
        C:\Windows\system32\pruxowl.exe 1608 "C:\Windows\SysWOW64\fsiaexe.exe"
        121⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\zjkdtmf.exe
        
        C:\Windows\system32\zjkdtmf.exe 1760 "C:\Windows\SysWOW64\pruxowl.exe"
        122⤵
        Modifies registry class
        NTFS ADS
        
        PID:4888
        
        C:\Windows\SysWOW64\hnuqkxq.exe
        
        C:\Windows\system32\hnuqkxq.exe 1896 "C:\Windows\SysWOW64\zjkdtmf.exe"
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Windows\SysWOW64\uaegqbp.exe
        
        C:\Windows\system32\uaegqbp.exe 1900 "C:\Windows\SysWOW64\hnuqkxq.exe"
        124⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\wzqdaaw.exe
        
        C:\Windows\system32\wzqdaaw.exe 1888 "C:\Windows\SysWOW64\uaegqbp.exe"
        125⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\hvjnqux.exe
        
        C:\Windows\system32\hvjnqux.exe 1648 "C:\Windows\SysWOW64\wzqdaaw.exe"
        126⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\uialwyw.exe
        
        C:\Windows\system32\uialwyw.exe 1628 "C:\Windows\SysWOW64\hvjnqux.exe"
        127⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\hvkbcuv.exe
        
        C:\Windows\system32\hvkbcuv.exe 1928 "C:\Windows\SysWOW64\uialwyw.exe"
        128⤵
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\uqbrhyu.exe
        
        C:\Windows\system32\uqbrhyu.exe 1748 "C:\Windows\SysWOW64\hvkbcuv.exe"
        129⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\cxxjund.exe
        
        C:\Windows\system32\cxxjund.exe 1788 "C:\Windows\SysWOW64\uqbrhyu.exe"
        130⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\pkgyzrc.exe
        
        C:\Windows\system32\pkgyzrc.exe 1768 "C:\Windows\SysWOW64\cxxjund.exe"
        131⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\wpqmrcn.exe
        
        C:\Windows\system32\wpqmrcn.exe 1780 "C:\Windows\SysWOW64\pkgyzrc.exe"
        132⤵
        Drops file in System32 directory
        
        PID:2596
        
        C:\Windows\SysWOW64\hkrwyxn.exe
        
        C:\Windows\system32\hkrwyxn.exe 1908 "C:\Windows\SysWOW64\wpqmrcn.exe"
        133⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\ruhbdvp.exe
        
        C:\Windows\system32\ruhbdvp.exe 1732 "C:\Windows\SysWOW64\hkrwyxn.exe"
        134⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cqautpq.exe
        
        C:\Windows\system32\cqautpq.exe 1800 "C:\Windows\SysWOW64\ruhbdvp.exe"
        135⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\mmbeakr.exe
        
        C:\Windows\system32\mmbeakr.exe 1740 "C:\Windows\SysWOW64\cqautpq.exe"
        136⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\ubwwvza.exe
        
        C:\Windows\system32\ubwwvza.exe 1948 "C:\Windows\SysWOW64\mmbeakr.exe"
        137⤵
        Checks BIOS information in registry
        
        PID:4616
        
        C:\Windows\SysWOW64\elmczpc.exe
        
        C:\Windows\system32\elmczpc.exe 1956 "C:\Windows\SysWOW64\ubwwvza.exe"
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\ryvsftb.exe
        
        C:\Windows\system32\ryvsftb.exe 1796 "C:\Windows\SysWOW64\elmczpc.exe"
        139⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\zdffxee.exe
        
        C:\Windows\system32\zdffxee.exe 1820 "C:\Windows\SysWOW64\ryvsftb.exe"
        140⤵
        Checks BIOS information in registry
        
        PID:2104
        
        C:\Windows\SysWOW64\jygpezm.exe
        
        C:\Windows\system32\jygpezm.exe 1792 "C:\Windows\SysWOW64\zdffxee.exe"
        141⤵
        
        PID:980
        
        C:\Windows\SysWOW64\uqwvjpg.exe
        
        C:\Windows\system32\uqwvjpg.exe 1972 "C:\Windows\SysWOW64\jygpezm.exe"
        142⤵
        Modifies registry class
        
        PID:708
        
        C:\Windows\SysWOW64\byjndmq.exe
        
        C:\Windows\system32\byjndmq.exe 1968 "C:\Windows\SysWOW64\uqwvjpg.exe"
        143⤵
        NTFS ADS
        
        PID:5064
        
        C:\Windows\SysWOW64\mtkflhr.exe
        
        C:\Windows\system32\mtkflhr.exe 1808 "C:\Windows\SysWOW64\byjndmq.exe"
        144⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\wmadqxt.exe
        
        C:\Windows\system32\wmadqxt.exe 1832 "C:\Windows\SysWOW64\mtkflhr.exe"
        145⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\eqkqhiv.exe
        
        C:\Windows\system32\eqkqhiv.exe 1804 "C:\Windows\SysWOW64\wmadqxt.exe"
        146⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\ollapce.exe
        
        C:\Windows\system32\ollapce.exe 1988 "C:\Windows\SysWOW64\eqkqhiv.exe"
        147⤵
        Checks BIOS information in registry
        
        PID:2320
        
        C:\Windows\SysWOW64\cvjlscw.exe
        
        C:\Windows\system32\cvjlscw.exe 1776 "C:\Windows\SysWOW64\ollapce.exe"
        148⤵
        
        PID:376
        
        C:\Windows\SysWOW64\mqkvzwf.exe
        
        C:\Windows\system32\mqkvzwf.exe 1276 "C:\Windows\SysWOW64\cvjlscw.exe"
        149⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\wqwtsve.exe
        
        C:\Windows\system32\wqwtsve.exe 1816 "C:\Windows\SysWOW64\mqkvzwf.exe"
        150⤵
        Modifies registry class
        
        PID:508
        
        C:\Windows\SysWOW64\kdgryzl.exe
        
        C:\Windows\system32\kdgryzl.exe 1856 "C:\Windows\SysWOW64\wqwtsve.exe"
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
        
        C:\Windows\SysWOW64\uygbfum.exe
        
        C:\Windows\system32\uygbfum.exe 1840 "C:\Windows\SysWOW64\kdgryzl.exe"
        152⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\exlyysu.exe
        
        C:\Windows\system32\exlyysu.exe 1852 "C:\Windows\SysWOW64\uygbfum.exe"
        153⤵
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:3960
        
        C:\Windows\SysWOW64\owxwirt.exe
        
        C:\Windows\system32\owxwirt.exe 1872 "C:\Windows\SysWOW64\exlyysu.exe"
        154⤵
        Checks BIOS information in registry
        
        PID:3008
        
        C:\Windows\SysWOW64\zombnhv.exe
        
        C:\Windows\system32\zombnhv.exe 1784 "C:\Windows\SysWOW64\owxwirt.exe"
        155⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\khchsxx.exe
        
        C:\Windows\system32\khchsxx.exe 1844 "C:\Windows\SysWOW64\zombnhv.exe"
        156⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\uggekwf.exe
        
        C:\Windows\system32\uggekwf.exe 1828 "C:\Windows\SysWOW64\khchsxx.exe"
        157⤵
        Checks BIOS information in registry
        
        PID:852
        
        C:\Windows\SysWOW64\htyuqad.exe
        
        C:\Windows\system32\htyuqad.exe 1860 "C:\Windows\SysWOW64\uggekwf.exe"
        158⤵
        NTFS ADS
        
        PID:2420
        
        C:\Windows\SysWOW64\oalmcpn.exe
        
        C:\Windows\system32\oalmcpn.exe 1848 "C:\Windows\SysWOW64\htyuqad.exe"
        159⤵
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\ckrxfpf.exe
        
        C:\Windows\system32\ckrxfpf.exe 2052 "C:\Windows\SysWOW64\oalmcpn.exe"
        160⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\mrduxom.exe
        
        C:\Windows\system32\mrduxom.exe 1916 "C:\Windows\SysWOW64\ckrxfpf.exe"
        161⤵
        Checks BIOS information in registry
        
        PID:2032
        
        C:\Windows\SysWOW64\wbtaceo.exe
        
        C:\Windows\system32\wbtaceo.exe 2060 "C:\Windows\SysWOW64\mrduxom.exe"
        162⤵
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\efvfupr.exe
        
        C:\Windows\system32\efvfupr.exe 1868 "C:\Windows\SysWOW64\wbtaceo.exe"
        163⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\oehceoz.exe
        
        C:\Windows\system32\oehceoz.exe 1880 "C:\Windows\SysWOW64\efvfupr.exe"
        164⤵
        NTFS ADS
        
        PID:5036
        
        C:\Windows\SysWOW64\zwxijeb.exe
        
        C:\Windows\system32\zwxijeb.exe 1932 "C:\Windows\SysWOW64\oehceoz.exe"
        165⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:2772
        
        C:\Windows\SysWOW64\bwbfbda.exe
        
        C:\Windows\system32\bwbfbda.exe 1940 "C:\Windows\SysWOW64\zwxijeb.exe"
        166⤵
        Checks BIOS information in registry
        
        PID:3432
        
        C:\Windows\SysWOW64\morkgtc.exe
        
        C:\Windows\system32\morkgtc.exe 1912 "C:\Windows\SysWOW64\bwbfbda.exe"
        167⤵
        Checks BIOS information in registry
        
        PID:2560
        
        C:\Windows\SysWOW64\wjsvond.exe
        
        C:\Windows\system32\wjsvond.exe 1892 "C:\Windows\SysWOW64\morkgtc.exe"
        168⤵
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\gfsnvim.exe
        
        C:\Windows\system32\gfsnvim.exe 1952 "C:\Windows\SysWOW64\wjsvond.exe"
        169⤵
        NTFS ADS
        
        PID:4448
        
        C:\Windows\SysWOW64\rxiliyf.exe
        
        C:\Windows\system32\rxiliyf.exe 1936 "C:\Windows\SysWOW64\gfsnvim.exe"
        170⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\yfvluvp.exe
        
        C:\Windows\system32\yfvluvp.exe 1960 "C:\Windows\SysWOW64\rxiliyf.exe"
        171⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\jxlqhmr.exe
        
        C:\Windows\system32\jxlqhmr.exe 2100 "C:\Windows\SysWOW64\yfvluvp.exe"
        172⤵
        
        PID:640
        
        C:\Windows\SysWOW64\usmbpgs.exe
        
        C:\Windows\system32\usmbpgs.exe 1876 "C:\Windows\SysWOW64\jxlqhmr.exe"
        173⤵
        
        PID:712
        
        C:\Windows\SysWOW64\eccgtwu.exe
        
        C:\Windows\system32\eccgtwu.exe 1920 "C:\Windows\SysWOW64\usmbpgs.exe"
        174⤵
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\ojgeevb.exe
        
        C:\Windows\system32\ojgeevb.exe 1964 "C:\Windows\SysWOW64\eccgtwu.exe"
        175⤵
        
        PID:232
        
        C:\Windows\SysWOW64\yjsbwuj.exe
        
        C:\Windows\system32\yjsbwuj.exe 1520 "C:\Windows\SysWOW64\ojgeevb.exe"
        176⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\msyeztb.exe
        
        C:\Windows\system32\msyeztb.exe 2116 "C:\Windows\SysWOW64\yjsbwuj.exe"
        177⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\worwhoc.exe
        
        C:\Windows\system32\worwhoc.exe 2004 "C:\Windows\SysWOW64\msyeztb.exe"
        178⤵
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\hjshoik.exe
        
        C:\Windows\system32\hjshoik.exe 1924 "C:\Windows\SysWOW64\worwhoc.exe"
        179⤵
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\orfhjyu.exe
        
        C:\Windows\system32\orfhjyu.exe 2132 "C:\Windows\SysWOW64\hjshoik.exe"
        180⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\bamkmxm.exe
        
        C:\Windows\system32\bamkmxm.exe 1984 "C:\Windows\SysWOW64\orfhjyu.exe"
        181⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\ldjuzaa.exe
        
        C:\Windows\system32\ldjuzaa.exe 2012 "C:\Windows\SysWOW64\bamkmxm.exe"
        182⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\wsnmjmv.exe
        
        C:\Windows\system32\wsnmjmv.exe 2144 "C:\Windows\SysWOW64\ldjuzaa.exe"
        183⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\ezbfvbf.exe
        
        C:\Windows\system32\ezbfvbf.exe 2028 "C:\Windows\SysWOW64\wsnmjmv.exe"
        184⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\orqkisz.exe
        
        C:\Windows\system32\orqkisz.exe 2008 "C:\Windows\SysWOW64\ezbfvbf.exe"
        185⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\yrchsqg.exe
        
        C:\Windows\system32\yrchsqg.exe 2160 "C:\Windows\SysWOW64\orqkisz.exe"
        186⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\lhxkbzm.exe
        
        C:\Windows\system32\lhxkbzm.exe 1980 "C:\Windows\SysWOW64\yrchsqg.exe"
        187⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\wwcddkh.exe
        
        C:\Windows\system32\wwcddkh.exe 2000 "C:\Windows\SysWOW64\lhxkbzm.exe"
        188⤵
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\gvoavjp.exe
        
        C:\Windows\system32\gvoavjp.exe 1996 "C:\Windows\SysWOW64\wwcddkh.exe"
        189⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\rndfazj.exe
        
        C:\Windows\system32\rndfazj.exe 2172 "C:\Windows\SysWOW64\gvoavjp.exe"
        190⤵
        NTFS ADS
        
        PID:3040
        
        C:\Windows\SysWOW64\bptqncx.exe
        
        C:\Windows\system32\bptqncx.exe 1944 "C:\Windows\SysWOW64\rndfazj.exe"
        191⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\miinstz.exe
        
        C:\Windows\system32\miinstz.exe 2024 "C:\Windows\SysWOW64\bptqncx.exe"
        192⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\whmllry.exe
        
        C:\Windows\system32\whmllry.exe 2180 "C:\Windows\SysWOW64\miinstz.exe"
        193⤵
        Drops file in System32 directory
        
        PID:4252
        
        C:\Windows\SysWOW64\gcndsmh.exe
        
        C:\Windows\system32\gcndsmh.exe 1992 "C:\Windows\SysWOW64\whmllry.exe"
        194⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\tpftyqg.exe
        
        C:\Windows\system32\tpftyqg.exe 2032 "C:\Windows\SysWOW64\gcndsmh.exe"
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\elydgkh.exe
        
        C:\Windows\system32\elydgkh.exe 2088 "C:\Windows\SysWOW64\tpftyqg.exe"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Windows\SysWOW64\rueorkh.exe
        
        C:\Windows\system32\rueorkh.exe 2056 "C:\Windows\SysWOW64\elydgkh.exe"
        197⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\bbqlbig.exe
        
        C:\Windows\system32\bbqlbig.exe 2068 "C:\Windows\SysWOW64\rueorkh.exe"
        198⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\ooabhmn.exe
        
        C:\Windows\system32\ooabhmn.exe 2212 "C:\Windows\SysWOW64\bbqlbig.exe"
        199⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\zkbuoho.exe
        
        C:\Windows\system32\zkbuoho.exe 2016 "C:\Windows\SysWOW64\ooabhmn.exe"
        200⤵
        Drops file in System32 directory
        
        PID:1952
        
        C:\Windows\SysWOW64\jjfrhgv.exe
        
        C:\Windows\system32\jjfrhgv.exe 2020 "C:\Windows\SysWOW64\zkbuoho.exe"
        201⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\ubuomwp.exe
        
        C:\Windows\system32\ubuomwp.exe 1672 "C:\Windows\SysWOW64\jjfrhgv.exe"
        202⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\eaguwux.exe
        
        C:\Windows\system32\eaguwux.exe 2064 "C:\Windows\SysWOW64\ubuomwp.exe"
        203⤵
        Drops file in System32 directory
        
        PID:664
        
        C:\Windows\SysWOW64\rrbxfvc.exe
        
        C:\Windows\system32\rrbxfvc.exe 2092 "C:\Windows\SysWOW64\eaguwux.exe"
        204⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\eaiziuc.exe
        
        C:\Windows\system32\eaiziuc.exe 2084 "C:\Windows\SysWOW64\rrbxfvc.exe"
        205⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\didrcke.exe
        
        C:\Windows\system32\didrcke.exe 2104 "C:\Windows\SysWOW64\eaiziuc.exe"
        206⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\rrbcfje.exe
        
        C:\Windows\system32\rrbcfje.exe 2072 "C:\Windows\SysWOW64\didrcke.exe"
        207⤵
        NTFS ADS
        
        PID:2284
        
        C:\Windows\SysWOW64\bznapil.exe
        
        C:\Windows\system32\bznapil.exe 2244 "C:\Windows\SysWOW64\rrbcfje.exe"
        208⤵
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\jvynhbo.exe
        
        C:\Windows\system32\jvynhbo.exe 2120 "C:\Windows\SysWOW64\bznapil.exe"
        209⤵
        Checks BIOS information in registry
        
        PID:4900
        
        C:\Windows\SysWOW64\tnnklrq.exe
        
        C:\Windows\system32\tnnklrq.exe 2252 "C:\Windows\SysWOW64\jvynhbo.exe"
        210⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\yahsftv.exe
        
        C:\Windows\system32\yahsftv.exe 2248 "C:\Windows\SysWOW64\tnnklrq.exe"
        211⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\jgllhnq.exe
        
        C:\Windows\system32\jgllhnq.exe 2136 "C:\Windows\SysWOW64\yahsftv.exe"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\oxifdtb.exe
        
        C:\Windows\system32\oxifdtb.exe 2108 "C:\Windows\SysWOW64\jgllhnq.exe"
        213⤵
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:3964
        
        C:\Windows\SysWOW64\ypxdhjd.exe
        
        C:\Windows\system32\ypxdhjd.exe 2292 "C:\Windows\SysWOW64\oxifdtb.exe"
        214⤵
        Drops file in System32 directory
        
        PID:4668
        
        C:\Windows\SysWOW64\gpwdwyh.exe
        
        C:\Windows\system32\gpwdwyh.exe 2036 "C:\Windows\SysWOW64\ypxdhjd.exe"
        215⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Windows\SysWOW64\tcotctg.exe
        
        C:\Windows\system32\tcotctg.exe 1264 "C:\Windows\SysWOW64\gpwdwyh.exe"
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:4116
        
        C:\Windows\SysWOW64\bhyglnj.exe
        
        C:\Windows\system32\bhyglnj.exe 2128 "C:\Windows\SysWOW64\tcotctg.exe"
        217⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\ouqwriq.exe
        
        C:\Windows\system32\ouqwriq.exe 2148 "C:\Windows\SysWOW64\bhyglnj.exe"
        218⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\wysjics.exe
        
        C:\Windows\system32\wysjics.exe 2280 "C:\Windows\SysWOW64\ouqwriq.exe"
        219⤵
        Checks BIOS information in registry
        
        PID:4892
        
        C:\Windows\SysWOW64\ducwsnv.exe
        
        C:\Windows\system32\ducwsnv.exe 2076 "C:\Windows\SysWOW64\wysjics.exe"
        220⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\rdizdmv.exe
        
        C:\Windows\system32\rdizdmv.exe 2308 "C:\Windows\SysWOW64\ducwsnv.exe"
        221⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\ylerpcf.exe
        
        C:\Windows\system32\ylerpcf.exe 2152 "C:\Windows\SysWOW64\rdizdmv.exe"
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Windows\SysWOW64\lvccsbw.exe
        
        C:\Windows\system32\lvccsbw.exe 2112 "C:\Windows\SysWOW64\ylerpcf.exe"
        223⤵
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\wqdmawf.exe
        
        C:\Windows\system32\wqdmawf.exe 2316 "C:\Windows\SysWOW64\lvccsbw.exe"
        224⤵
        NTFS ADS
        
        PID:2980
        
        C:\Windows\SysWOW64\dyymulh.exe
        
        C:\Windows\system32\dyymulh.exe 2164 "C:\Windows\SysWOW64\wqdmawf.exe"
        225⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\qticapo.exe
        
        C:\Windows\system32\qticapo.exe 2312 "C:\Windows\SysWOW64\dyymulh.exe"
        226⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\bsuzkon.exe
        
        C:\Windows\system32\bsuzkon.exe 2044 "C:\Windows\SysWOW64\qticapo.exe"
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:4512
        
        C:\Windows\SysWOW64\lckfxep.exe
        
        C:\Windows\system32\lckfxep.exe 2184 "C:\Windows\SysWOW64\bsuzkon.exe"
        228⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\tgmkgpa.exe
        
        C:\Windows\system32\tgmkgpa.exe 2140 "C:\Windows\SysWOW64\lckfxep.exe"
        229⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\gtdamtz.exe
        
        C:\Windows\system32\gtdamtz.exe 2192 "C:\Windows\SysWOW64\tgmkgpa.exe"
        230⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\qpescnz.exe
        
        C:\Windows\system32\qpescnz.exe 2188 "C:\Windows\SysWOW64\gtdamtz.exe"
        231⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\bhupgdb.exe
        
        C:\Windows\system32\bhupgdb.exe 2196 "C:\Windows\SysWOW64\qpescnz.exe"
        232⤵
        NTFS ADS
        
        PID:2524
        
        C:\Windows\SysWOW64\ldvioyc.exe
        
        C:\Windows\system32\ldvioyc.exe 2080 "C:\Windows\SysWOW64\bhupgdb.exe"
        233⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\vnksjbi.exe
        
        C:\Windows\system32\vnksjbi.exe 2208 "C:\Windows\SysWOW64\ldvioyc.exe"
        234⤵
        NTFS ADS
        
        PID:4304
        
        C:\Windows\SysWOW64\gjddrvj.exe
        
        C:\Windows\system32\gjddrvj.exe 2168 "C:\Windows\SysWOW64\vnksjbi.exe"
        235⤵
        Modifies registry class
        
        PID:2976
        
        C:\Windows\SysWOW64\tsjnuvj.exe
        
        C:\Windows\system32\tsjnuvj.exe 2200 "C:\Windows\SysWOW64\gjddrvj.exe"
        236⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\bafggkt.exe
        
        C:\Windows\system32\bafggkt.exe 2176 "C:\Windows\SysWOW64\tsjnuvj.exe"
        237⤵
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\ojlirkt.exe
        
        C:\Windows\system32\ojlirkt.exe 2232 "C:\Windows\SysWOW64\bafggkt.exe"
        238⤵
        Modifies registry class
        NTFS ADS
        
        PID:4556
        
        C:\Windows\SysWOW64\baglasq.exe
        
        C:\Windows\system32\baglasq.exe 2284 "C:\Windows\SysWOW64\ojlirkt.exe"
        239⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\jbflgzu.exe
        
        C:\Windows\system32\jbflgzu.exe 2156 "C:\Windows\SysWOW64\baglasq.exe"
        240⤵
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:4760
        
        C:\Windows\SysWOW64\tarjryc.exe
        
        C:\Windows\system32\tarjryc.exe 2420 "C:\Windows\SysWOW64\jbflgzu.exe"
        241⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\esyoeoe.exe
        
        C:\Windows\system32\esyoeoe.exe 2220 "C:\Windows\SysWOW64\tarjryc.exe"
        242⤵
        
        PID:832
        
        C:\Windows\SysWOW64\onzylie.exe
        
        C:\Windows\system32\onzylie.exe 2236 "C:\Windows\SysWOW64\esyoeoe.exe"
        243⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\ynlewhm.exe
        
        C:\Windows\system32\ynlewhm.exe 2384 "C:\Windows\SysWOW64\onzylie.exe"
        244⤵
        NTFS ADS
        
        PID:4088
        
        C:\Windows\SysWOW64\jfbbifg.exe
        
        C:\Windows\system32\jfbbifg.exe 2216 "C:\Windows\SysWOW64\ynlewhm.exe"
        245⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\lefzten.exe
        
        C:\Windows\system32\lefzten.exe 2320 "C:\Windows\SysWOW64\jfbbifg.exe"
        246⤵
        Modifies registry class
        
        PID:2904
        
        C:\Windows\SysWOW64\sipmkpy.exe
        
        C:\Windows\system32\sipmkpy.exe 1272 "C:\Windows\SysWOW64\lefzten.exe"
        247⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\grwxnoq.exe
        
        C:\Windows\system32\grwxnoq.exe 2264 "C:\Windows\SysWOW64\sipmkpy.exe"
        248⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\qrauyny.exe
        
        C:\Windows\system32\qrauyny.exe 2260 "C:\Windows\SysWOW64\grwxnoq.exe"
        249⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\ambffiy.exe
        
        C:\Windows\system32\ambffiy.exe 2272 "C:\Windows\SysWOW64\qrauyny.exe"
        250⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\leqksya.exe
        
        C:\Windows\system32\leqksya.exe 2268 "C:\Windows\SysWOW64\ambffiy.exe"
        251⤵
        Drops file in System32 directory
        
        PID:2056
        
        C:\Windows\SysWOW64\varuasb.exe
        
        C:\Windows\system32\varuasb.exe 2276 "C:\Windows\SysWOW64\leqksya.exe"
        252⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\fcgfnvp.exe
        
        C:\Windows\system32\fcgfnvp.exe 2228 "C:\Windows\SysWOW64\varuasb.exe"
        253⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\qyzxuqq.exe
        
        C:\Windows\system32\qyzxuqq.exe 2300 "C:\Windows\SysWOW64\fcgfnvp.exe"
        254⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\auaikkr.exe
        
        C:\Windows\system32\auaikkr.exe 2296 "C:\Windows\SysWOW64\qyzxuqq.exe"
        255⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\lpbssfs.exe
        
        C:\Windows\system32\lpbssfs.exe 2204 "C:\Windows\SysWOW64\auaikkr.exe"
        256⤵
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\vlclzza.exe
        
        C:\Windows\system32\vlclzza.exe 2440 "C:\Windows\SysWOW64\lpbssfs.exe"
        257⤵
        Checks BIOS information in registry
        
        PID:2784
        
        C:\Windows\SysWOW64\gdrimpu.exe
        
        C:\Windows\system32\gdrimpu.exe 2444 "C:\Windows\SysWOW64\vlclzza.exe"
        258⤵
        Drops file in System32 directory
        
        PID:4584
        
        C:\Windows\SysWOW64\qzkaukd.exe
        
        C:\Windows\system32\qzkaukd.exe 2488 "C:\Windows\SysWOW64\gdrimpu.exe"
        259⤵
        Modifies registry class
        NTFS ADS
        
        PID:2324
        
        C:\Windows\SysWOW64\ydvglvg.exe
        
        C:\Windows\system32\ydvglvg.exe 2328 "C:\Windows\SysWOW64\qzkaukd.exe"
        260⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\fvtgskk.exe
        
        C:\Windows\system32\fvtgskk.exe 2124 "C:\Windows\SysWOW64\ydvglvg.exe"
        261⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\qojlwae.exe
        
        C:\Windows\system32\qojlwae.exe 2456 "C:\Windows\SysWOW64\fvtgskk.exe"
        262⤵
        
        PID:400
        
        C:\Windows\SysWOW64\ystyolo.exe
        
        C:\Windows\system32\ystyolo.exe 2224 "C:\Windows\SysWOW64\qojlwae.exe"
        263⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\inujvgp.exe
        
        C:\Windows\system32\inujvgp.exe 2476 "C:\Windows\SysWOW64\ystyolo.exe"
        264⤵
        
        PID:992
        
        C:\Windows\SysWOW64\tfkoawr.exe
        
        C:\Windows\system32\tfkoawr.exe 2240 "C:\Windows\SysWOW64\inujvgp.exe"
        265⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\anxgutt.exe
        
        C:\Windows\system32\anxgutt.exe 2368 "C:\Windows\SysWOW64\tfkoawr.exe"
        266⤵
        
        PID:216
        
        C:\Windows\SysWOW64\igwhjax.exe
        
        C:\Windows\system32\igwhjax.exe 2468 "C:\Windows\SysWOW64\anxgutt.exe"
        267⤵
        
        PID:896
        
        C:\Windows\SysWOW64\tymmoqz.exe
        
        C:\Windows\system32\tymmoqz.exe 2288 "C:\Windows\SysWOW64\igwhjax.exe"
        268⤵
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\fasuzdd.exe
        
        C:\Windows\system32\fasuzdd.exe 2484 "C:\Windows\SysWOW64\tymmoqz.exe"
        269⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\ntrugjh.exe
        
        C:\Windows\system32\ntrugjh.exe 2348 "C:\Windows\SysWOW64\fasuzdd.exe"
        270⤵
        Checks BIOS information in registry
        
        PID:4988
        
        C:\Windows\SysWOW64\agikung.exe
        
        C:\Windows\system32\agikung.exe 2304 "C:\Windows\SysWOW64\ntrugjh.exe"
        271⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\lyypydi.exe
        
        C:\Windows\system32\lyypydi.exe 2324 "C:\Windows\SysWOW64\agikung.exe"
        272⤵
        NTFS ADS
        
        PID:4984
        
        C:\Windows\SysWOW64\vinzmgo.exe
        
        C:\Windows\system32\vinzmgo.exe 2256 "C:\Windows\SysWOW64\lyypydi.exe"
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Windows\SysWOW64\dbmaans.exe
        
        C:\Windows\system32\dbmaans.exe 2336 "C:\Windows\SysWOW64\vinzmgo.exe"
        274⤵
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\ntcffdu.exe
        
        C:\Windows\system32\ntcffdu.exe 2504 "C:\Windows\SysWOW64\dbmaans.exe"
        275⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Windows\SysWOW64\vxmkowx.exe
        
        C:\Windows\system32\vxmkowx.exe 2520 "C:\Windows\SysWOW64\ntcffdu.exe"
        276⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\dqlkddb.exe
        
        C:\Windows\system32\dqlkddb.exe 2352 "C:\Windows\SysWOW64\vxmkowx.exe"
        277⤵
        NTFS ADS
        
        PID:3588
        
        C:\Windows\SysWOW64\oiaqitd.exe
        
        C:\Windows\system32\oiaqitd.exe 2492 "C:\Windows\SysWOW64\dqlkddb.exe"
        278⤵
        Drops file in System32 directory
        
        PID:3048
        
        C:\Windows\SysWOW64\vqwicre.exe
        
        C:\Windows\system32\vqwicre.exe 2376 "C:\Windows\SysWOW64\oiaqitd.exe"
        279⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\flpakln.exe
        
        C:\Windows\system32\flpakln.exe 2540 "C:\Windows\SysWOW64\vqwicre.exe"
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\nqzgbwq.exe
        
        C:\Windows\system32\nqzgbwq.exe 2372 "C:\Windows\SysWOW64\flpakln.exe"
        281⤵
        NTFS ADS
        
        PID:1740
        
        C:\Windows\SysWOW64\adrvhao.exe
        
        C:\Windows\system32\adrvhao.exe 2340 "C:\Windows\SysWOW64\nqzgbwq.exe"
        282⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\lyjopvp.exe
        
        C:\Windows\system32\lyjopvp.exe 2392 "C:\Windows\SysWOW64\adrvhao.exe"
        283⤵
        
        PID:364
        
        C:\Windows\SysWOW64\vukywpy.exe
        
        C:\Windows\system32\vukywpy.exe 2388 "C:\Windows\SysWOW64\lyjopvp.exe"
        284⤵
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\ahcoctx.exe
        
        C:\Windows\system32\ahcoctx.exe 2332 "C:\Windows\SysWOW64\vukywpy.exe"
        285⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Windows\SysWOW64\kogtuse.exe
        
        C:\Windows\system32\kogtuse.exe 2380 "C:\Windows\SysWOW64\ahcoctx.exe"
        286⤵
        
        PID:996
        
        C:\Windows\SysWOW64\vukewez.exe
        
        C:\Windows\system32\vukewez.exe 2572 "C:\Windows\SysWOW64\kogtuse.exe"
        287⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\dcgertj.exe
        
        C:\Windows\system32\dcgertj.exe 2500 "C:\Windows\SysWOW64\vukewez.exe"
        288⤵
        NTFS ADS
        
        PID:1272
        
        C:\Windows\SysWOW64\qpxuwxi.exe
        
        C:\Windows\system32\qpxuwxi.exe 2404 "C:\Windows\SysWOW64\dcgertj.exe"
        289⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\awbrhwp.exe
        
        C:\Windows\system32\awbrhwp.exe 2356 "C:\Windows\SysWOW64\qpxuwxi.exe"
        290⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\nyickvh.exe
        
        C:\Windows\system32\nyickvh.exe 2416 "C:\Windows\SysWOW64\awbrhwp.exe"
        291⤵
        
        PID:788
        
        C:\Windows\SysWOW64\ytjmrqq.exe
        
        C:\Windows\system32\ytjmrqq.exe 2400 "C:\Windows\SysWOW64\nyickvh.exe"
        292⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\iankkop.exe
        
        C:\Windows\system32\iankkop.exe 2396 "C:\Windows\SysWOW64\ytjmrqq.exe"
        293⤵
        Drops file in System32 directory
        
        PID:4728
        
        C:\Windows\SysWOW64\sarhufx.exe
        
        C:\Windows\system32\sarhufx.exe 2436 "C:\Windows\SysWOW64\iankkop.exe"
        294⤵
        
        PID:624
        
        C:\Windows\SysWOW64\iaoxvov.exe
        
        C:\Windows\system32\iaoxvov.exe 2528 "C:\Windows\SysWOW64\sarhufx.exe"
        295⤵
        
        PID:636
        
        C:\Windows\SysWOW64\qfycfzy.exe
        
        C:\Windows\system32\qfycfzy.exe 2604 "C:\Windows\SysWOW64\iaoxvov.exe"
        296⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\aazvuuy.exe
        
        C:\Windows\system32\aazvuuy.exe 2432 "C:\Windows\SysWOW64\qfycfzy.exe"
        297⤵
        NTFS ADS
        
        PID:4328
        
        C:\Windows\SysWOW64\iimnhri.exe
        
        C:\Windows\system32\iimnhri.exe 2532 "C:\Windows\SysWOW64\aazvuuy.exe"
        298⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\vvecmnh.exe
        
        C:\Windows\system32\vvecmnh.exe 2608 "C:\Windows\SysWOW64\iimnhri.exe"
        299⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\SysWOW64\ieknpmh.exe
        
        C:\Windows\system32\ieknpmh.exe 2460 "C:\Windows\SysWOW64\vvecmnh.exe"
        300⤵
        Checks BIOS information in registry
        
        PID:4832
        
        C:\Windows\SysWOW64\shzylpn.exe
        
        C:\Windows\system32\shzylpn.exe 2620 "C:\Windows\SysWOW64\ieknpmh.exe"
        301⤵
        Drops file in System32 directory
        
        PID:528
        
        C:\Windows\SysWOW64\dweinbq.exe
        
        C:\Windows\system32\dweinbq.exe 2628 "C:\Windows\SysWOW64\shzylpn.exe"
        302⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\nrfauwr.exe
        
        C:\Windows\system32\nrfauwr.exe 2640 "C:\Windows\SysWOW64\dweinbq.exe"
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
        
        C:\Windows\SysWOW64\ynglkqs.exe
        
        C:\Windows\system32\ynglkqs.exe 2452 "C:\Windows\SysWOW64\nrfauwr.exe"
        304⤵
        Checks BIOS information in registry
        NTFS ADS
        
        PID:1032
        
        C:\Windows\SysWOW64\iiydrls.exe
        
        C:\Windows\system32\iiydrls.exe 2448 "C:\Windows\SysWOW64\ynglkqs.exe"
        305⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\sloofoh.exe
        
        C:\Windows\system32\sloofoh.exe 2648 "C:\Windows\SysWOW64\iiydrls.exe"
        306⤵
        NTFS ADS
        
        PID:4476
        
        C:\Windows\SysWOW64\dddlreb.exe
        
        C:\Windows\system32\dddlreb.exe 2408 "C:\Windows\SysWOW64\sloofoh.exe"
        307⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\nzeezyj.exe
        
        C:\Windows\system32\nzeezyj.exe 2644 "C:\Windows\SysWOW64\dddlreb.exe"
        308⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\xyqbjxj.exe
        
        C:\Windows\system32\xyqbjxj.exe 2656 "C:\Windows\SysWOW64\nzeezyj.exe"
        309⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\kwlesfp.exe
        
        C:\Windows\system32\kwlesfp.exe 2664 "C:\Windows\SysWOW64\xyqbjxj.exe"
        310⤵
        Checks BIOS information in registry
        
        PID:3112
        
        C:\Windows\SysWOW64\aximton.exe
        
        C:\Windows\system32\aximton.exe 2636 "C:\Windows\SysWOW64\kwlesfp.exe"
        311⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\ltbwbjn.exe
        
        C:\Windows\system32\ltbwbjn.exe 2428 "C:\Windows\SysWOW64\aximton.exe"
        312⤵
        Drops file in System32 directory
        
        PID:464
        
        C:\Windows\SysWOW64\sawwvyx.exe
        
        C:\Windows\system32\sawwvyx.exe 2424 "C:\Windows\SysWOW64\ltbwbjn.exe"
        313⤵
        Drops file in System32 directory
        
        PID:3640
        
        C:\Windows\SysWOW64\frrzegc.exe
        
        C:\Windows\system32\frrzegc.exe 2360 "C:\Windows\SysWOW64\sawwvyx.exe"
        314⤵
        Checks BIOS information in registry
        
        PID:1008
        
        C:\Windows\SysWOW64\smjpjcb.exe
        
        C:\Windows\system32\smjpjcb.exe 2512 "C:\Windows\SysWOW64\frrzegc.exe"
        315⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\cikzrxc.exe
        
        C:\Windows\system32\cikzrxc.exe 2464 "C:\Windows\SysWOW64\smjpjcb.exe"
        316⤵
        
        PID:512
        
        C:\Windows\SysWOW64\pyfcifh.exe
        
        C:\Windows\system32\pyfcifh.exe 2680 "C:\Windows\SysWOW64\cikzrxc.exe"
        317⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Windows\SysWOW64\dilnlez.exe
        
        C:\Windows\system32\dilnlez.exe 2524 "C:\Windows\SysWOW64\pyfcifh.exe"
        318⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\nhpkvdh.exe
        
        C:\Windows\system32\nhpkvdh.exe 2480 "C:\Windows\SysWOW64\dilnlez.exe"
        319⤵
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\xgbhfcp.exe
        
        C:\Windows\system32\xgbhfcp.exe 2544 "C:\Windows\SysWOW64\nhpkvdh.exe"
        320⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\iyrnssr.exe
        
        C:\Windows\system32\iyrnssr.exe 2344 "C:\Windows\SysWOW64\xgbhfcp.exe"
        321⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\sxvkdrq.exe
        
        C:\Windows\system32\sxvkdrq.exe 2472 "C:\Windows\SysWOW64\iyrnssr.exe"
        322⤵
        Drops file in System32 directory
        
        PID:4924
        
        C:\Windows\SysWOW64\fsmaivx.exe
        
        C:\Windows\system32\fsmaivx.exe 2364 "C:\Windows\SysWOW64\sxvkdrq.exe"
        323⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\pofkqpy.exe
        
        C:\Windows\system32\pofkqpy.exe 2556 "C:\Windows\SysWOW64\fsmaivx.exe"
        324⤵
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\ajgdgky.exe
        
        C:\Windows\system32\ajgdgky.exe 2496 "C:\Windows\SysWOW64\pofkqpy.exe"
        325⤵
        NTFS ADS
        
        PID:460
        
        C:\Windows\SysWOW64\hfqipvb.exe
        
        C:\Windows\system32\hfqipvb.exe 2552 "C:\Windows\SysWOW64\ajgdgky.exe"
        326⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\kbraxpk.exe
        
        C:\Windows\system32\kbraxpk.exe 2508 "C:\Windows\SysWOW64\hfqipvb.exe"
        327⤵
        NTFS ADS
        
        PID:2448
        
        C:\Windows\SysWOW64\xkpdapc.exe
        
        C:\Windows\system32\xkpdapc.exe 2560 "C:\Windows\SysWOW64\kbraxpk.exe"
        328⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\igqwpjl.exe
        
        C:\Windows\system32\igqwpjl.exe 2516 "C:\Windows\SysWOW64\xkpdapc.exe"
        329⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\srggdmr.exe
        
        C:\Windows\system32\srggdmr.exe 2040 "C:\Windows\SysWOW64\igqwpjl.exe"
        330⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cjvdhct.exe
        
        C:\Windows\system32\cjvdhct.exe 2588 "C:\Windows\SysWOW64\srggdmr.exe"
        331⤵
        NTFS ADS
        
        PID:4824
        
        C:\Windows\SysWOW64\mihbabs.exe
        
        C:\Windows\system32\mihbabs.exe 2596 "C:\Windows\SysWOW64\cjvdhct.exe"
        332⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\xomtcnw.exe
        
        C:\Windows\system32\xomtcnw.exe 2744 "C:\Windows\SysWOW64\mihbabs.exe"
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Windows\SysWOW64\fwhtwcf.exe
        
        C:\Windows\system32\fwhtwcf.exe 2752 "C:\Windows\SysWOW64\xomtcnw.exe"
        334⤵
        NTFS ADS
        
        PID:3024
        
        C:\Windows\SysWOW64\svcwfld.exe
        
        C:\Windows\system32\svcwfld.exe 2576 "C:\Windows\SysWOW64\fwhtwcf.exe"
        335⤵
        Drops file in System32 directory
        
        PID:1940
        
        C:\Windows\SysWOW64\znbwlzh.exe
        
        C:\Windows\system32\znbwlzh.exe 2600 "C:\Windows\SysWOW64\svcwfld.exe"
        336⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Windows\SysWOW64\kcfhnlc.exe
        
        C:\Windows\system32\kcfhnlc.exe 2612 "C:\Windows\SysWOW64\znbwlzh.exe"
        337⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Windows\SysWOW64\sgpufwm.exe
        
        C:\Windows\system32\sgpufwm.exe 2772 "C:\Windows\SysWOW64\kcfhnlc.exe"
        338⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\acahohp.exe
        
        C:\Windows\system32\acahohp.exe 2548 "C:\Windows\SysWOW64\sgpufwm.exe"
        339⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:4868
        
        C:\Windows\SysWOW64\kjefggx.exe
        
        C:\Windows\system32\kjefggx.exe 2632 "C:\Windows\SysWOW64\acahohp.exe"
        340⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\uttklwr.exe
        
        C:\Windows\system32\uttklwr.exe 2776 "C:\Windows\SysWOW64\kjefggx.exe"
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Windows\SysWOW64\fpuutzz.exe
        
        C:\Windows\system32\fpuutzz.exe 2568 "C:\Windows\SysWOW64\uttklwr.exe"
        342⤵
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\plvfita.exe
        
        C:\Windows\system32\plvfita.exe 2652 "C:\Windows\SysWOW64\fpuutzz.exe"
        343⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\xpxssed.exe
        
        C:\Windows\system32\xpxssed.exe 2616 "C:\Windows\SysWOW64\plvfita.exe"
        344⤵
        
        PID:220
        
        C:\Windows\SysWOW64\hhnxfvf.exe
        
        C:\Windows\system32\hhnxfvf.exe 2792 "C:\Windows\SysWOW64\xpxssed.exe"
        345⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:2144
        
        C:\Windows\SysWOW64\szcvjlh.exe
        
        C:\Windows\system32\szcvjlh.exe 1364 "C:\Windows\SysWOW64\hhnxfvf.exe"
        346⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\zhyvwai.exe
        
        C:\Windows\system32\zhyvwai.exe 2800 "C:\Windows\SysWOW64\szcvjlh.exe"
        347⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\kczglvr.exe
        
        C:\Windows\system32\kczglvr.exe 2592 "C:\Windows\SysWOW64\zhyvwai.exe"
        348⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\rhbtvou.exe
        
        C:\Windows\system32\rhbtvou.exe 2672 "C:\Windows\SysWOW64\kczglvr.exe"
        349⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\fqhvynu.exe
        
        C:\Windows\system32\fqhvynu.exe 2816 "C:\Windows\SysWOW64\rhbtvou.exe"
        350⤵
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\sdzldjt.exe
        
        C:\Windows\system32\sdzldjt.exe 2820 "C:\Windows\SysWOW64\fqhvynu.exe"
        351⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\czaetet.exe
        
        C:\Windows\system32\czaetet.exe 2824 "C:\Windows\SysWOW64\sdzldjt.exe"
        352⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\ppugcmz.exe
        
        C:\Windows\system32\ppugcmz.exe 2684 "C:\Windows\SysWOW64\czaetet.exe"
        353⤵
        
        PID:752
        
        C:\Windows\SysWOW64\zozemkg.exe
        
        C:\Windows\system32\zozemkg.exe 2844 "C:\Windows\SysWOW64\ppugcmz.exe"
        354⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\mnbgvte.exe
        
        C:\Windows\system32\mnbgvte.exe 2828 "C:\Windows\SysWOW64\zozemkg.exe"
        355⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\awijyse.exe
        
        C:\Windows\system32\awijyse.exe 2840 "C:\Windows\SysWOW64\mnbgvte.exe"
        356⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\ksbbfnf.exe
        
        C:\Windows\system32\ksbbfnf.exe 2580 "C:\Windows\SysWOW64\awijyse.exe"
        357⤵
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\vnbmvho.exe
        
        C:\Windows\system32\vnbmvho.exe 2848 "C:\Windows\SysWOW64\ksbbfnf.exe"
        358⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\cvxehwp.exe
        
        C:\Windows\system32\cvxehwp.exe 2852 "C:\Windows\SysWOW64\vnbmvho.exe"
        359⤵
        Checks BIOS information in registry
        
        PID:3784
        
        C:\Windows\SysWOW64\pfvpkwp.exe
        
        C:\Windows\system32\pfvpkwp.exe 2660 "C:\Windows\SysWOW64\cvxehwp.exe"
        360⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\xmrhelz.exe
        
        C:\Windows\system32\xmrhelz.exe 2624 "C:\Windows\SysWOW64\pfvpkwp.exe"
        361⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\kwxshlz.exe
        
        C:\Windows\system32\kwxshlz.exe 2668 "C:\Windows\SysWOW64\xmrhelz.exe"
        362⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\uvbpsky.exe
        
        C:\Windows\system32\uvbpsky.exe 2696 "C:\Windows\SysWOW64\kwxshlz.exe"
        363⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\cwapgrc.exe
        
        C:\Windows\system32\cwapgrc.exe 2880 "C:\Windows\SysWOW64\uvbpsky.exe"
        364⤵
        Checks BIOS information in registry
        
        PID:1224
        
        C:\Windows\SysWOW64\kskuqcf.exe
        
        C:\Windows\system32\kskuqcf.exe 2676 "C:\Windows\SysWOW64\cwapgrc.exe"
        365⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\mzwaiam.exe
        
        C:\Windows\system32\mzwaiam.exe 2688 "C:\Windows\SysWOW64\kskuqcf.exe"
        366⤵
        NTFS ADS
        
        PID:4880
        
        C:\Windows\SysWOW64\zmgqoel.exe
        
        C:\Windows\system32\zmgqoel.exe 2768 "C:\Windows\SysWOW64\mzwaiam.exe"
        367⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\kevntun.exe
        
        C:\Windows\system32\kevntun.exe 2864 "C:\Windows\SysWOW64\zmgqoel.exe"
        368⤵
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\ragaknq.exe
        
        C:\Windows\system32\ragaknq.exe 2716 "C:\Windows\SysWOW64\kevntun.exe"
        369⤵
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\cwgtsiy.exe
        
        C:\Windows\system32\cwgtsiy.exe 2692 "C:\Windows\SysWOW64\ragaknq.exe"
        370⤵
        Checks BIOS information in registry
        
        PID:4704
        
        C:\Windows\SysWOW64\prqixex.exe
        
        C:\Windows\system32\prqixex.exe 2904 "C:\Windows\SysWOW64\cwgtsiy.exe"
        371⤵
        Drops file in System32 directory
        
        PID:1060
        
        C:\Windows\SysWOW64\zmrtfyy.exe
        
        C:\Windows\system32\zmrtfyy.exe 2736 "C:\Windows\SysWOW64\prqixex.exe"
        372⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\nziilcx.exe
        
        C:\Windows\system32\nziilcx.exe 2724 "C:\Windows\SysWOW64\zmrtfyy.exe"
        373⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\xyngdbe.exe
        
        C:\Windows\system32\xyngdbe.exe 2732 "C:\Windows\SysWOW64\nziilcx.exe"
        374⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\hyzloam.exe
        
        C:\Windows\system32\hyzloam.exe 2728 "C:\Windows\SysWOW64\xyngdbe.exe"
        375⤵
        Checks BIOS information in registry
        
        PID:5088
        
        C:\Windows\SysWOW64\uhxorzm.exe
        
        C:\Windows\system32\uhxorzm.exe 2704 "C:\Windows\SysWOW64\hyzloam.exe"
        376⤵
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\egjlbyl.exe
        
        C:\Windows\system32\egjlbyl.exe 2700 "C:\Windows\SysWOW64\uhxorzm.exe"
        377⤵
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\pckersu.exe
        
        C:\Windows\system32\pckersu.exe 2740 "C:\Windows\SysWOW64\egjlbyl.exe"
        378⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cxtuxwt.exe
        
        C:\Windows\system32\cxtuxwt.exe 2760 "C:\Windows\SysWOW64\pckersu.exe"
        379⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\mwgrhva.exe
        
        C:\Windows\system32\mwgrhva.exe 2708 "C:\Windows\SysWOW64\cxtuxwt.exe"
        380⤵
        Checks BIOS information in registry
        Modifies registry class
        NTFS ADS
        
        PID:2272
        
        C:\Windows\SysWOW64\xgvwmlu.exe
        
        C:\Windows\system32\xgvwmlu.exe 2780 "C:\Windows\SysWOW64\mwgrhva.exe"
        381⤵
        Drops file in System32 directory
        NTFS ADS
        
        PID:2216
        
        C:\Windows\SysWOW64\hcohbgd.exe
        
        C:\Windows\system32\hcohbgd.exe 2756 "C:\Windows\SysWOW64\xgvwmlu.exe"
        382⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\rjaemfd.exe
        
        C:\Windows\system32\rjaemfd.exe 2788 "C:\Windows\SysWOW64\hcohbgd.exe"
        383⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:1028
        
        C:\Windows\SysWOW64\ewkusij.exe
        
        C:\Windows\system32\ewkusij.exe 2956 "C:\Windows\SysWOW64\rjaemfd.exe"
        384⤵
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\prlmzdk.exe
        
        C:\Windows\system32\prlmzdk.exe 2812 "C:\Windows\SysWOW64\ewkusij.exe"
        385⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\znlxpxl.exe
        
        C:\Windows\system32\znlxpxl.exe 2712 "C:\Windows\SysWOW64\prlmzdk.exe"
        386⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\hrwkyio.exe
        
        C:\Windows\system32\hrwkyio.exe 2960 "C:\Windows\SysWOW64\znlxpxl.exe"
        387⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\rnpuodw.exe
        
        C:\Windows\system32\rnpuodw.exe 2968 "C:\Windows\SysWOW64\hrwkyio.exe"
        388⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cxeattq.exe
        
        C:\Windows\system32\cxeattq.exe 2804 "C:\Windows\SysWOW64\rnpuodw.exe"
        389⤵
        NTFS ADS
        
        PID:1912
        
        C:\Windows\SysWOW64\jbonceb.exe
        
        C:\Windows\system32\jbonceb.exe 2976 "C:\Windows\SysWOW64\cxeattq.exe"
        390⤵
        Drops file in System32 directory
        
        PID:4752
        
        C:\Windows\SysWOW64\uiskudb.exe
        
        C:\Windows\system32\uiskudb.exe 2972 "C:\Windows\SysWOW64\jbonceb.exe"
        391⤵
        Modifies registry class
        
        PID:5080
        
        C:\Windows\SysWOW64\esiizbd.exe
        
        C:\Windows\system32\esiizbd.exe 2748 "C:\Windows\SysWOW64\uiskudb.exe"
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Windows\SysWOW64\pojahvd.exe
        
        C:\Windows\system32\pojahvd.exe 2584 "C:\Windows\SysWOW64\esiizbd.exe"
        393⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\zjklwqm.exe
        
        C:\Windows\system32\zjklwqm.exe 2808 "C:\Windows\SysWOW64\pojahvd.exe"
        394⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\jqoihpm.exe
        
        C:\Windows\system32\jqoihpm.exe 2796 "C:\Windows\SysWOW64\zjklwqm.exe"
        395⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\xsutkgm.exe
        
        C:\Windows\system32\xsutkgm.exe 2868 "C:\Windows\SysWOW64\jqoihpm.exe"
        396⤵
        Drops file in System32 directory
        
        PID:4084
        
        C:\Windows\SysWOW64\hnvdrbm.exe
        
        C:\Windows\system32\hnvdrbm.exe 2832 "C:\Windows\SysWOW64\xsutkgm.exe"
        397⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\rvzbkau.exe
        
        C:\Windows\system32\rvzbkau.exe 2860 "C:\Windows\SysWOW64\hnvdrbm.exe"
        398⤵
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\cqatruv.exe
        
        C:\Windows\system32\cqatruv.exe 2876 "C:\Windows\SysWOW64\rvzbkau.exe"
        399⤵
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\pagwuuv.exe
        
        C:\Windows\system32\pagwuuv.exe 2888 "C:\Windows\SysWOW64\cqatruv.exe"
        400⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\xwrjmnx.exe
        
        C:\Windows\system32\xwrjmnx.exe 3016 "C:\Windows\SysWOW64\pagwuuv.exe"
        401⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\hrjuthg.exe
        
        C:\Windows\system32\hrjuthg.exe 2892 "C:\Windows\SysWOW64\xwrjmnx.exe"
        402⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\rnkmbch.exe
        
        C:\Windows\system32\rnkmbch.exe 2720 "C:\Windows\SysWOW64\hrjuthg.exe"
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Windows\SysWOW64\ficchxg.exe
        
        C:\Windows\system32\ficchxg.exe 2908 "C:\Windows\SysWOW64\rnkmbch.exe"
        404⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\memhyqi.exe
        
        C:\Windows\system32\memhyqi.exe 2856 "C:\Windows\SysWOW64\ficchxg.exe"
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:2148
        
        C:\Windows\SysWOW64\zgsxkvv.exe
        
        C:\Windows\system32\zgsxkvv.exe 2884 "C:\Windows\SysWOW64\memhyqi.exe"
        406⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\cvwpmpq.exe
        
        C:\Windows\system32\cvwpmpq.exe 2764 "C:\Windows\SysWOW64\zgsxkvv.exe"
        407⤵
        Modifies registry class
        NTFS ADS
        
        PID:3612
        
        C:\Windows\SysWOW64\mubmwox.exe
        
        C:\Windows\system32\mubmwox.exe 2916 "C:\Windows\SysWOW64\cvwpmpq.exe"
        408⤵
        NTFS ADS
        
        PID:3500
        
        C:\Windows\SysWOW64\uylanza.exe
        
        C:\Windows\system32\uylanza.exe 2920 "C:\Windows\SysWOW64\mubmwox.exe"
        409⤵
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\gpgcwhg.exe
        
        C:\Windows\system32\gpgcwhg.exe 3060 "C:\Windows\SysWOW64\uylanza.exe"
        410⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\rkgnebh.exe
        
        C:\Windows\system32\rkgnebh.exe 2896 "C:\Windows\SysWOW64\gpgcwhg.exe"
        411⤵
        Checks BIOS information in registry
        
        PID:5048
        
        C:\Windows\SysWOW64\bcwsqri.exe
        
        C:\Windows\system32\bcwsqri.exe 3004 "C:\Windows\SysWOW64\rkgnebh.exe"
        412⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\jhgfadl.exe
        
        C:\Windows\system32\jhgfadl.exe 2784 "C:\Windows\SysWOW64\bcwsqri.exe"
        413⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\xqmidcl.exe
        
        C:\Windows\system32\xqmidcl.exe 2932 "C:\Windows\SysWOW64\jhgfadl.exe"
        414⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\byjdzix.exe
        
        C:\Windows\system32\byjdzix.exe 3076 "C:\Windows\SysWOW64\xqmidcl.exe"
        415⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Windows\SysWOW64\mqzaegr.exe
        
        C:\Windows\system32\mqzaegr.exe 2872 "C:\Windows\SysWOW64\byjdzix.exe"
        416⤵
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\wqlywfy.exe
        
        C:\Windows\system32\wqlywfy.exe 2836 "C:\Windows\SysWOW64\mqzaegr.exe"
        417⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\glmqeaz.exe
        
        C:\Windows\system32\glmqeaz.exe 2924 "C:\Windows\SysWOW64\wqlywfy.exe"
        418⤵
        NTFS ADS
        
        PID:3012
        
        C:\Windows\SysWOW64\rdboiqb.exe
        
        C:\Windows\system32\rdboiqb.exe 3092 "C:\Windows\SysWOW64\glmqeaz.exe"
        419⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\bzugykc.exe
        
        C:\Windows\system32\bzugykc.exe 3100 "C:\Windows\SysWOW64\rdboiqb.exe"
        420⤵
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\jdethvm.exe
        
        C:\Windows\system32\jdethvm.exe 2948 "C:\Windows\SysWOW64\bzugykc.exe"
        421⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\wnlwkve.exe
        
        C:\Windows\system32\wnlwkve.exe 3116 "C:\Windows\SysWOW64\jdethvm.exe"
        422⤵
        Drops file in System32 directory
        
        PID:3396
        
        C:\Windows\SysWOW64\himgspn.exe
        
        C:\Windows\system32\himgspn.exe 2936 "C:\Windows\SysWOW64\wnlwkve.exe"
        423⤵
        Drops file in System32 directory
        
        PID:740
        
        C:\Windows\SysWOW64\refziko.exe
        
        C:\Windows\system32\refziko.exe 2984 "C:\Windows\SysWOW64\himgspn.exe"
        424⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\zipervr.exe
        
        C:\Windows\system32\zipervr.exe 3124 "C:\Windows\SysWOW64\refziko.exe"
        425⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\gmzrjot.exe
        
        C:\Windows\system32\gmzrjot.exe 2944 "C:\Windows\SysWOW64\zipervr.exe"
        426⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\oijesze.exe
        
        C:\Windows\system32\oijesze.exe 3120 "C:\Windows\SysWOW64\gmzrjot.exe"
        427⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\zxnxclz.exe
        
        C:\Windows\system32\zxnxclz.exe 2912 "C:\Windows\SysWOW64\oijesze.exe"
        428⤵
        Drops file in System32 directory
        
        PID:1120
        
        C:\Windows\SysWOW64\hbyclwc.exe
        
        C:\Windows\system32\hbyclwc.exe 2952 "C:\Windows\SysWOW64\zxnxclz.exe"
        429⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\rxyubyd.exe
        
        C:\Windows\system32\rxyubyd.exe 3140 "C:\Windows\SysWOW64\hbyclwc.exe"
        430⤵
        Checks BIOS information in registry
        
        PID:4388
        
        C:\Windows\SysWOW64\ekikhuk.exe
        
        C:\Windows\system32\ekikhuk.exe 2988 "C:\Windows\SysWOW64\rxyubyd.exe"
        431⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\mrdctst.exe
        
        C:\Windows\system32\mrdctst.exe 2940 "C:\Windows\SysWOW64\ekikhuk.exe"
        432⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\zenszns.exe
        
        C:\Windows\system32\zenszns.exe 3000 "C:\Windows\SysWOW64\mrdctst.exe"
        433⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\jdzxrmr.exe
        
        C:\Windows\system32\jdzxrmr.exe 3196 "C:\Windows\SysWOW64\zenszns.exe"
        434⤵
        NTFS ADS
        
        PID:4576
        
        C:\Windows\SysWOW64\wnfaumr.exe
        
        C:\Windows\system32\wnfaumr.exe 3112 "C:\Windows\SysWOW64\jdzxrmr.exe"
        435⤵
        NTFS ADS
        
        PID:4224
        
        C:\Windows\SysWOW64\japqaqq.exe
        
        C:\Windows\system32\japqaqq.exe 3164 "C:\Windows\SysWOW64\wnfaumr.exe"
        436⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\uwqiikz.exe
        
        C:\Windows\system32\uwqiikz.exe 2900 "C:\Windows\SysWOW64\japqaqq.exe"
        437⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\egftvnf.exe
        
        C:\Windows\system32\egftvnf.exe 3036 "C:\Windows\SysWOW64\uwqiikz.exe"
        438⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\rqmvynf.exe
        
        C:\Windows\system32\rqmvynf.exe 2928 "C:\Windows\SysWOW64\egftvnf.exe"
        439⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\eggygnd.exe
        
        C:\Windows\system32\eggygnd.exe 3024 "C:\Windows\SysWOW64\rqmvynf.exe"
        440⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\locqbkm.exe
        
        C:\Windows\system32\locqbkm.exe 3020 "C:\Windows\SysWOW64\eggygnd.exe"
        441⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\wjdjifn.exe
        
        C:\Windows\system32\wjdjifn.exe 3040 "C:\Windows\SysWOW64\locqbkm.exe"
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\jemyobu.exe
        
        C:\Windows\system32\jemyobu.exe 3096 "C:\Windows\SysWOW64\wjdjifn.exe"
        443⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\upcebro.exe
        
        C:\Windows\system32\upcebro.exe 2980 "C:\Windows\SysWOW64\jemyobu.exe"
        444⤵
        Checks BIOS information in registry
        
        PID:5236
        
        C:\Windows\SysWOW64\ekdoilw.exe
        
        C:\Windows\system32\ekdoilw.exe 3192 "C:\Windows\SysWOW64\upcebro.exe"
        445⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\lsqgdjy.exe
        
        C:\Windows\system32\lsqgdjy.exe 3044 "C:\Windows\SysWOW64\ekdoilw.exe"
        446⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\teybzod.exe
        
        C:\Windows\system32\teybzod.exe 3032 "C:\Windows\SysWOW64\lsqgdjy.exe"
        447⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\eoohlex.exe
        
        C:\Windows\system32\eoohlex.exe 2992 "C:\Windows\SysWOW64\teybzod.exe"
        448⤵
        Drops file in System32 directory
        NTFS ADS
        
        PID:5768
        
        C:\Windows\SysWOW64\ovsewde.exe
        
        C:\Windows\system32\ovsewde.exe 2964 "C:\Windows\SysWOW64\eoohlex.exe"
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\wscrnwh.exe
        
        C:\Windows\system32\wscrnwh.exe 3008 "C:\Windows\SysWOW64\ovsewde.exe"
        450⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\jbjuqnh.exe
        
        C:\Windows\system32\jbjuqnh.exe 3048 "C:\Windows\SysWOW64\wscrnwh.exe"
        451⤵
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\tinrbmp.exe
        
        C:\Windows\system32\tinrbmp.exe 3104 "C:\Windows\SysWOW64\jbjuqnh.exe"
        452⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\eeokihp.exe
        
        C:\Windows\system32\eeokihp.exe 3068 "C:\Windows\SysWOW64\tinrbmp.exe"
        453⤵
        NTFS ADS
        
        PID:5220
        
        C:\Windows\SysWOW64\laypaas.exe
        
        C:\Windows\system32\laypaas.exe 3084 "C:\Windows\SysWOW64\eeokihp.exe"
        454⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\wwzihub.exe
        
        C:\Windows\system32\wwzihub.exe 3108 "C:\Windows\SysWOW64\laypaas.exe"
        455⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\grrsppb.exe
        
        C:\Windows\system32\grrsppb.exe 3248 "C:\Windows\SysWOW64\wwzihub.exe"
        456⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\qnskejc.exe
        
        C:\Windows\system32\qnskejc.exe 2996 "C:\Windows\SysWOW64\grrsppb.exe"
        457⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\bitvmed.exe
        
        C:\Windows\system32\bitvmed.exe 3064 "C:\Windows\SysWOW64\qnskejc.exe"
        458⤵
        Drops file in System32 directory
        NTFS ADS
        
        PID:6068
        
        C:\Windows\SysWOW64\indidpo.exe
        
        C:\Windows\system32\indidpo.exe 3252 "C:\Windows\SysWOW64\bitvmed.exe"
        459⤵
        NTFS ADS
        
        PID:5140
        
        C:\Windows\SysWOW64\tftfifi.exe
        
        C:\Windows\system32\tftfifi.exe 3080 "C:\Windows\SysWOW64\indidpo.exe"
        460⤵
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:4732
        
        C:\Windows\SysWOW64\gscdojo.exe
        
        C:\Windows\system32\gscdojo.exe 3012 "C:\Windows\SysWOW64\tftfifi.exe"
        461⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\rndowdp.exe
        
        C:\Windows\system32\rndowdp.exe 3148 "C:\Windows\SysWOW64\gscdojo.exe"
        462⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\yvrgqtz.exe
        
        C:\Windows\system32\yvrgqtz.exe 3208 "C:\Windows\SysWOW64\rndowdp.exe"
        463⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\jkdysmu.exe
        
        C:\Windows\system32\jkdysmu.exe 3144 "C:\Windows\SysWOW64\yvrgqtz.exe"
        464⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\tfwrzhv.exe
        
        C:\Windows\system32\tfwrzhv.exe 3028 "C:\Windows\SysWOW64\jkdysmu.exe"
        465⤵
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\ebxbpbv.exe
        
        C:\Windows\system32\ebxbpbv.exe 3168 "C:\Windows\SysWOW64\tfwrzhv.exe"
        466⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\oabyzad.exe
        
        C:\Windows\system32\oabyzad.exe 3312 "C:\Windows\SysWOW64\ebxbpbv.exe"
        467⤵
        Checks BIOS information in registry
        
        PID:6088
        
        C:\Windows\SysWOW64\yznwkzk.exe
        
        C:\Windows\system32\yznwkzk.exe 3156 "C:\Windows\SysWOW64\oabyzad.exe"
        468⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\ivooatl.exe
        
        C:\Windows\system32\ivooatl.exe 3052 "C:\Windows\SysWOW64\yznwkzk.exe"
        469⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\wemrctl.exe
        
        C:\Windows\system32\wemrctl.exe 3088 "C:\Windows\SysWOW64\ivooatl.exe"
        470⤵
        NTFS ADS
        
        PID:680
        
        C:\Windows\SysWOW64\ganjknm.exe
        
        C:\Windows\system32\ganjknm.exe 3184 "C:\Windows\SysWOW64\wemrctl.exe"
        471⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\oexpcyp.exe
        
        C:\Windows\system32\oexpcyp.exe 3136 "C:\Windows\SysWOW64\ganjknm.exe"
        472⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\ydbmmxw.exe
        
        C:\Windows\system32\ydbmmxw.exe 3304 "C:\Windows\SysWOW64\oexpcyp.exe"
        473⤵
        Checks BIOS information in registry
        
        PID:6044
        
        C:\Windows\SysWOW64\lmixpxw.exe
        
        C:\Windows\system32\lmixpxw.exe 3128 "C:\Windows\SysWOW64\ydbmmxw.exe"
        474⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\wijhxrx.exe
        
        C:\Windows\system32\wijhxrx.exe 3180 "C:\Windows\SysWOW64\lmixpxw.exe"
        475⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\ghnfpqf.exe
        
        C:\Windows\system32\ghnfpqf.exe 3200 "C:\Windows\SysWOW64\wijhxrx.exe"
        476⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\qdoxxlf.exe
        
        C:\Windows\system32\qdoxxlf.exe 3056 "C:\Windows\SysWOW64\ghnfpqf.exe"
        477⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\dbqafll.exe
        
        C:\Windows\system32\dbqafll.exe 3176 "C:\Windows\SysWOW64\qdoxxlf.exe"
        478⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\rlpcikl.exe
        
        C:\Windows\system32\rlpcikl.exe 3172 "C:\Windows\SysWOW64\dbqafll.exe"
        479⤵
        Checks BIOS information in registry
        
        PID:5888
        
        C:\Windows\SysWOW64\bkbatjk.exe
        
        C:\Windows\system32\bkbatjk.exe 3340 "C:\Windows\SysWOW64\rlpcikl.exe"
        480⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\lcqffzm.exe
        
        C:\Windows\system32\lcqffzm.exe 3188 "C:\Windows\SysWOW64\bkbatjk.exe"
        481⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\wbvdqyu.exe
        
        C:\Windows\system32\wbvdqyu.exe 3212 "C:\Windows\SysWOW64\lcqffzm.exe"
        482⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Windows\SysWOW64\gahaaxb.exe
        
        C:\Windows\system32\gahaaxb.exe 3132 "C:\Windows\SysWOW64\wbvdqyu.exe"
        483⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\qwatqrc.exe
        
        C:\Windows\system32\qwatqrc.exe 3356 "C:\Windows\SysWOW64\gahaaxb.exe"
        484⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\bradxmd.exe
        
        C:\Windows\system32\bradxmd.exe 3216 "C:\Windows\SysWOW64\qwatqrc.exe"
        485⤵
        Checks BIOS information in registry
        
        PID:5328
        
        C:\Windows\SysWOW64\ljqiccf.exe
        
        C:\Windows\system32\ljqiccf.exe 3364 "C:\Windows\SysWOW64\bradxmd.exe"
        486⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\wfrtkwg.exe
        
        C:\Windows\system32\wfrtkwg.exe 3232 "C:\Windows\SysWOW64\ljqiccf.exe"
        487⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\yevqcvn.exe
        
        C:\Windows\system32\yevqcvn.exe 3240 "C:\Windows\SysWOW64\wfrtkwg.exe"
        488⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\lobbfvn.exe
        
        C:\Windows\system32\lobbfvn.exe 3220 "C:\Windows\SysWOW64\yevqcvn.exe"
        489⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\ybtrlym.exe
        
        C:\Windows\system32\ybtrlym.exe 3160 "C:\Windows\SysWOW64\lobbfvn.exe"
        490⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\dnmzeir.exe
        
        C:\Windows\system32\dnmzeir.exe 3388 "C:\Windows\SysWOW64\ybtrlym.exe"
        491⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\ojfjmdr.exe
        
        C:\Windows\system32\ojfjmdr.exe 3296 "C:\Windows\SysWOW64\dnmzeir.exe"
        492⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\yirhwbz.exe
        
        C:\Windows\system32\yirhwbz.exe 3244 "C:\Windows\SysWOW64\ojfjmdr.exe"
        493⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\jxwzgnu.exe
        
        C:\Windows\system32\jxwzgnu.exe 3400 "C:\Windows\SysWOW64\yirhwbz.exe"
        494⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Windows\SysWOW64\tsxroid.exe
        
        C:\Windows\system32\tsxroid.exe 3396 "C:\Windows\SysWOW64\jxwzgnu.exe"
        495⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\drbpyhc.exe
        
        C:\Windows\system32\drbpyhc.exe 3236 "C:\Windows\SysWOW64\tsxroid.exe"
        496⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\nqnmrfk.exe
        
        C:\Windows\system32\nqnmrfk.exe 3228 "C:\Windows\SysWOW64\drbpyhc.exe"
        497⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\adwcwjj.exe
        
        C:\Windows\system32\adwcwjj.exe 3420 "C:\Windows\SysWOW64\nqnmrfk.exe"
        498⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\ondnzbj.exe
        
        C:\Windows\system32\ondnzbj.exe 3328 "C:\Windows\SysWOW64\adwcwjj.exe"
        499⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\ymhkkzq.exe
        
        C:\Windows\system32\ymhkkzq.exe 3324 "C:\Windows\SysWOW64\ondnzbj.exe"
        500⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\iiivrur.exe
        
        C:\Windows\system32\iiivrur.exe 3272 "C:\Windows\SysWOW64\ymhkkzq.exe"
        501⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\tdinhos.exe
        
        C:\Windows\system32\tdinhos.exe 3436 "C:\Windows\SysWOW64\iiivrur.exe"
        502⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\ahtsqhc.exe
        
        C:\Windows\system32\ahtsqhc.exe 3280 "C:\Windows\SysWOW64\tdinhos.exe"
        503⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\imdfitf.exe
        
        C:\Windows\system32\imdfitf.exe 3432 "C:\Windows\SysWOW64\ahtsqhc.exe"
        504⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\teklnjh.exe
        
        C:\Windows\system32\teklnjh.exe 3268 "C:\Windows\SysWOW64\imdfitf.exe"
        505⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\dwairzb.exe
        
        C:\Windows\system32\dwairzb.exe 3452 "C:\Windows\SysWOW64\teklnjh.exe"
        506⤵
        NTFS ADS
        
        PID:6024
        
        C:\Windows\SysWOW64\orbbhtk.exe
        
        C:\Windows\system32\orbbhtk.exe 3348 "C:\Windows\SysWOW64\dwairzb.exe"
        507⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\vzwttrt.exe
        
        C:\Windows\system32\vzwttrt.exe 3276 "C:\Windows\SysWOW64\orbbhtk.exe"
        508⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\gvplblu.exe
        
        C:\Windows\system32\gvplblu.exe 3284 "C:\Windows\SysWOW64\vzwttrt.exe"
        509⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\tewoelm.exe
        
        C:\Windows\system32\tewoelm.exe 3292 "C:\Windows\SysWOW64\gvplblu.exe"
        510⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\amrgyaw.exe
        
        C:\Windows\system32\amrgyaw.exe 3300 "C:\Windows\SysWOW64\tewoelm.exe"
        511⤵
        Checks BIOS information in registry
        
        PID:5952
        
        C:\Windows\SysWOW64\liszgve.exe
        
        C:\Windows\system32\liszgve.exe 3476 "C:\Windows\SysWOW64\amrgyaw.exe"
        512⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\vshwsly.exe
        
        C:\Windows\system32\vshwsly.exe 3264 "C:\Windows\SysWOW64\liszgve.exe"
        513⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\gnaoafh.exe
        
        C:\Windows\system32\gnaoafh.exe 3484 "C:\Windows\SysWOW64\vshwsly.exe"
        514⤵
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:5876
        
        C:\Windows\SysWOW64\qjbziai.exe
        
        C:\Windows\system32\qjbziai.exe 3480 "C:\Windows\SysWOW64\gnaoafh.exe"
        515⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\becrxuj.exe
        
        C:\Windows\system32\becrxuj.exe 3224 "C:\Windows\SysWOW64\qjbziai.exe"
        516⤵
        Drops file in System32 directory
        
        PID:1352
        
        C:\Windows\SysWOW64\ozmhdyh.exe
        
        C:\Windows\system32\ozmhdyh.exe 3532 "C:\Windows\SysWOW64\becrxuj.exe"
        517⤵
        Modifies registry class
        
        PID:384
        
        C:\Windows\SysWOW64\yzyeoxp.exe
        
        C:\Windows\system32\yzyeoxp.exe 3492 "C:\Windows\SysWOW64\ozmhdyh.exe"
        518⤵
        NTFS ADS
        
        PID:5368
        
        C:\Windows\SysWOW64\iurpvrq.exe
        
        C:\Windows\system32\iurpvrq.exe 3496 "C:\Windows\SysWOW64\yzyeoxp.exe"
        519⤵
        Modifies registry class
        
        PID:180
        
        C:\Windows\SysWOW64\tqrhlmy.exe
        
        C:\Windows\system32\tqrhlmy.exe 3504 "C:\Windows\SysWOW64\iurpvrq.exe"
        520⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\dihfqcs.exe
        
        C:\Windows\system32\dihfqcs.exe 3488 "C:\Windows\SysWOW64\tqrhlmy.exe"
        521⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\lpcfcrc.exe
        
        C:\Windows\system32\lpcfcrc.exe 3204 "C:\Windows\SysWOW64\dihfqcs.exe"
        522⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\vlvprmd.exe
        
        C:\Windows\system32\vlvprmd.exe 3320 "C:\Windows\SysWOW64\lpcfcrc.exe"
        523⤵
        Checks BIOS information in registry
        
        PID:4428
        
        C:\Windows\SysWOW64\iynfxqj.exe
        
        C:\Windows\system32\iynfxqj.exe 3516 "C:\Windows\SysWOW64\vlvprmd.exe"
        524⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\tuoxfkk.exe
        
        C:\Windows\system32\tuoxfkk.exe 3316 "C:\Windows\SysWOW64\iynfxqj.exe"
        525⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\dmddkam.exe
        
        C:\Windows\system32\dmddkam.exe 3564 "C:\Windows\SysWOW64\tuoxfkk.exe"
        526⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\ohwnzvn.exe
        
        C:\Windows\system32\ohwnzvn.exe 3308 "C:\Windows\SysWOW64\dmddkam.exe"
        527⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\npsflkw.exe
        
        C:\Windows\system32\npsflkw.exe 3536 "C:\Windows\SysWOW64\ohwnzvn.exe"
        528⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\yzhlyiq.exe
        
        C:\Windows\system32\yzhlyiq.exe 3540 "C:\Windows\SysWOW64\npsflkw.exe"
        529⤵
        NTFS ADS
        
        PID:5908
        
        C:\Windows\SysWOW64\ivivgdz.exe
        
        C:\Windows\system32\ivivgdz.exe 3256 "C:\Windows\SysWOW64\yzhlyiq.exe"
        530⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\qzkipoc.exe
        
        C:\Windows\system32\qzkipoc.exe 3352 "C:\Windows\SysWOW64\ivivgdz.exe"
        531⤵
        NTFS ADS
        
        PID:2908
        
        C:\Windows\SysWOW64\araocee.exe
        
        C:\Windows\system32\araocee.exe 3336 "C:\Windows\SysWOW64\qzkipoc.exe"
        532⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\lnbykyf.exe
        
        C:\Windows\system32\lnbykyf.exe 3152 "C:\Windows\SysWOW64\araocee.exe"
        533⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\yasopcd.exe
        
        C:\Windows\system32\yasopcd.exe 3376 "C:\Windows\SysWOW64\lnbykyf.exe"
        534⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\fhgoksn.exe
        
        C:\Windows\system32\fhgoksn.exe 3560 "C:\Windows\SysWOW64\yasopcd.exe"
        535⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\qzvmoip.exe
        
        C:\Windows\system32\qzvmoip.exe 3380 "C:\Windows\SysWOW64\fhgoksn.exe"
        536⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\xhrmbxy.exe
        
        C:\Windows\system32\xhrmbxy.exe 3372 "C:\Windows\SysWOW64\qzvmoip.exe"
        537⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\lrxpexq.exe
        
        C:\Windows\system32\lrxpexq.exe 3460 "C:\Windows\SysWOW64\xhrmbxy.exe"
        538⤵
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\sylpyua.exe
        
        C:\Windows\system32\sylpyua.exe 3572 "C:\Windows\SysWOW64\lrxpexq.exe"
        539⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\dqamdkc.exe
        
        C:\Windows\system32\dqamdkc.exe 3584 "C:\Windows\SysWOW64\sylpyua.exe"
        540⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\nbqspaw.exe
        
        C:\Windows\system32\nbqspaw.exe 3588 "C:\Windows\SysWOW64\dqamdkc.exe"
        541⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Windows\SysWOW64\vfafzmg.exe
        
        C:\Windows\system32\vfafzmg.exe 3360 "C:\Windows\SysWOW64\nbqspaw.exe"
        542⤵
        NTFS ADS
        
        PID:6000
        
        C:\Windows\SysWOW64\gxqceci.exe
        
        C:\Windows\system32\gxqceci.exe 3580 "C:\Windows\SysWOW64\vfafzmg.exe"
        543⤵
        
        PID:408
        
        C:\Windows\SysWOW64\nfdcyzk.exe
        
        C:\Windows\system32\nfdcyzk.exe 3456 "C:\Windows\SysWOW64\gxqceci.exe"
        544⤵
        
        PID:936
        
        C:\Windows\SysWOW64\xaenfut.exe
        
        C:\Windows\system32\xaenfut.exe 3568 "C:\Windows\SysWOW64\nfdcyzk.exe"
        545⤵
        NTFS ADS
        
        PID:3120
        
        C:\Windows\SysWOW64\lkkqill.exe
        
        C:\Windows\system32\lkkqill.exe 3608 "C:\Windows\SysWOW64\xaenfut.exe"
        546⤵
        Checks BIOS information in registry
        
        PID:5696
        
        C:\Windows\SysWOW64\vjovbks.exe
        
        C:\Windows\system32\vjovbks.exe 3512 "C:\Windows\SysWOW64\lkkqill.exe"
        547⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\gbesgau.exe
        
        C:\Windows\system32\gbesgau.exe 3616 "C:\Windows\SysWOW64\vjovbks.exe"
        548⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\njztaxe.exe
        
        C:\Windows\system32\njztaxe.exe 3412 "C:\Windows\SysWOW64\gbesgau.exe"
        549⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\xeadhse.exe
        
        C:\Windows\system32\xeadhse.exe 3628 "C:\Windows\SysWOW64\njztaxe.exe"
        550⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\iwqimig.exe
        
        C:\Windows\system32\iwqimig.exe 3624 "C:\Windows\SysWOW64\xeadhse.exe"
        551⤵
        Checks BIOS information in registry
        
        PID:5832
        
        C:\Windows\SysWOW64\pedbgyi.exe
        
        C:\Windows\system32\pedbgyi.exe 3632 "C:\Windows\SysWOW64\iwqimig.exe"
        552⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\awtglok.exe
        
        C:\Windows\system32\awtglok.exe 3408 "C:\Windows\SysWOW64\pedbgyi.exe"
        553⤵
        Checks BIOS information in registry
        
        PID:5356
        
        C:\Windows\SysWOW64\ksuqtil.exe
        
        C:\Windows\system32\ksuqtil.exe 3644 "C:\Windows\SysWOW64\awtglok.exe"
        554⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\soeekbv.exe
        
        C:\Windows\system32\soeekbv.exe 3636 "C:\Windows\SysWOW64\ksuqtil.exe"
        555⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\cjxosww.exe
        
        C:\Windows\system32\cjxosww.exe 3344 "C:\Windows\SysWOW64\soeekbv.exe"
        556⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\nfygzqx.exe
        
        C:\Windows\system32\nfygzqx.exe 3404 "C:\Windows\SysWOW64\cjxosww.exe"
        557⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\yxnemgz.exe
        
        C:\Windows\system32\yxnemgz.exe 3444 "C:\Windows\SysWOW64\nfygzqx.exe"
        558⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\fbxrwrc.exe
        
        C:\Windows\system32\fbxrwrc.exe 3416 "C:\Windows\SysWOW64\yxnemgz.exe"
        559⤵
        Modifies registry class
        
        PID:3744
        
        C:\Windows\SysWOW64\tleuzrc.exe
        
        C:\Windows\system32\tleuzrc.exe 3428 "C:\Windows\SysWOW64\fbxrwrc.exe"
        560⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\dgxmolc.exe
        
        C:\Windows\system32\dgxmolc.exe 3424 "C:\Windows\SysWOW64\tleuzrc.exe"
        561⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\kosebbm.exe
        
        C:\Windows\system32\kosebbm.exe 3448 "C:\Windows\SysWOW64\dgxmolc.exe"
        562⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\vktxivn.exe
        
        C:\Windows\system32\vktxivn.exe 3676 "C:\Windows\SysWOW64\kosebbm.exe"
        563⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\fcjuvlp.exe
        
        C:\Windows\system32\fcjuvlp.exe 3384 "C:\Windows\SysWOW64\vktxivn.exe"
        564⤵
        NTFS ADS
        
        PID:5764
        
        C:\Windows\SysWOW64\njwuhjy.exe
        
        C:\Windows\system32\njwuhjy.exe 3684 "C:\Windows\SysWOW64\fcjuvlp.exe"
        565⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\xfxfxdz.exe
        
        C:\Windows\system32\xfxfxdz.exe 3468 "C:\Windows\SysWOW64\njwuhjy.exe"
        566⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\dpdqadz.exe
        
        C:\Windows\system32\dpdqadz.exe 3368 "C:\Windows\SysWOW64\xfxfxdz.exe"
        567⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\nkeahxa.exe
        
        C:\Windows\system32\nkeahxa.exe 3500 "C:\Windows\SysWOW64\dpdqadz.exe"
        568⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\xgxkpsa.exe
        
        C:\Windows\system32\xgxkpsa.exe 3260 "C:\Windows\SysWOW64\nkeahxa.exe"
        569⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        NTFS ADS
        
        PID:5520
        
        C:\Windows\SysWOW64\hfjqhri.exe
        
        C:\Windows\system32\hfjqhri.exe 3392 "C:\Windows\SysWOW64\xgxkpsa.exe"
        570⤵
        NTFS ADS
        
        PID:5780
        
        C:\Windows\SysWOW64\vstgnmh.exe
        
        C:\Windows\system32\vstgnmh.exe 3700 "C:\Windows\SysWOW64\hfjqhri.exe"
        571⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\frfdylo.exe
        
        C:\Windows\system32\frfdylo.exe 3556 "C:\Windows\SysWOW64\vstgnmh.exe"
        572⤵
        
        PID:5616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
7b3e45c4ff8561fd686821c84ebda737

SHA1
bfd952fe7de32f218e02263b978a361328e45b40

SHA256
bbd988c0e03d44e7d760fb8d2b76ccc6e280c777213151fe09418208b621d162

SHA512
88538dd408b097331f93961b713254d08c6059a68a53b3826c86764762fd6c344b304c6987bab0f1b5d0a20922f0fd21635a103e5d516f7caafd0d007de4aebd

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
bc619ca055713627f3e92caac2911d04

SHA1
31d65bd1448b7bed7a78836183f2049683027dd1

SHA256
df4fbdd51d76a4ec483978ade487b7ec0bbdbdb3bf5c4b32f3a75433abf4ff63

SHA512
27f08c9e1f3d06d801b9464a51c5c0cec1a03143c329d687b67e37d93755045f23c153a7bf497bc149f187da3d3785b147046ca5d20361d64232b6d213deaf90

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
65f2b4b728c158b3b8244d1b5b9db871

SHA1
fa631ea8ca2ba0fa925c5d8eaca81f4a68275904

SHA256
29b864873215768f8a801490121b93a3c1c7f4d944b5fc8e1f678c6696f327a5

SHA512
c407b9f4038e14f186809229ded67823208bbff951b8ee10e0b6635a86b760f4ddbd2ade207ab7c46bfab8a73934529586d1c963c55658d914bcf3995a18910d

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
2b37f8fbe704579fdf60170a75a8c68f

SHA1
10bc1cfdddd805638f2417fc6c4d2b653f3c6be1

SHA256
08739aa95e9d934e98581f409266ddb823b5ababb6bb177bf9f37bc739375d27

SHA512
fe62d68836bf33b2ea9ab4f587b9a8920c5192a8eb97324264bb2fae47c83da1e2a8c1de20a1b21cbab42d5edb7e6ce4717ec6362b045d23600ebc188c010d7a

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
6ce1bd16f504f9e08a516ea8be78937f

SHA1
42b1bcd07d3db403ea5c09577ed3354f30aef626

SHA256
1e08c6188a2caa8059971a1d3a9e08552d686e396c614f8e33710f2a85ce1558

SHA512
7c38664045d35bddb57dc96c0b67b185948cebb6096a30baf756e65b2637fdf406a4a08cb5852d3bf3c56f7c72db298624fea4106233448aff1512be14cc8f1d

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
97e0db23456a3b9b396f79a04e61882f

SHA1
ab05ab73cce00026f0c0752798897769c6a27b36

SHA256
5a2c05505f541e7400cc2858dbb74ac250da1fcffca44cc4e52490b920ec469a

SHA512
75341eb8105ff2f101ce40708101f8912642df9a63af585d73be61daa3071e6cffd4b0f9250a9e2d83856af01bc4f21a40f63db1f005be0f98c60ae781c32983

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
845ebef3ba20ececa1c43954d4165541

SHA1
e78a6d5f5d056487bae47e880db0d9a63f4c146e

SHA256
c837c598c78428bd3ec7c4fed60db5c7b79ec9a790ed836e8a7ddaf5ea15c79d

SHA512
2e6ba23261a5b8b8b005f71b1f60b6233731d639a5cd49a4ae523c560b758f83c10f1db2287e8206beec170d25a7cf332433313a2272a88db7352deff7d24513

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
2cf2f8e956d1342ecb8ce0bfaea9419b

SHA1
2aa771b4549e1223da3f937515cba4d95ab722d8

SHA256
47d8f665a491f8b8d358bf9be95dcdcace77157e43238f7fd70cec0540f9780f

SHA512
5f60ba2813e8320fd9caa6cf10b4df87300000f9dd31dd2d1e880033b55739fbaadd6107a736a6813bbd266db02005b05d7aceccf71ce85ff5244055852e38b7

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
ad8d2b87e507cf83827dd7cce89eecdd

SHA1
4eb201f675c86fe153cca7684aef9a213131d957

SHA256
b6255d51014a842460d2e4620ace5186fa646f69c9eb4069ae9a7096b24eaff6

SHA512
a11c3bec781d298c7c0a21ea310364e626c125e47951ccc31b67fa387b90d72f00d112074efc5f6e9cdeb7417b4e32be44192207006bd9ab8c5ac7b7885f39c8

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
e325fd0941bfc33eb46d91d7d3571cad

SHA1
b8c4ad35b70f26bdc791a0a7a06dd321bfd20e27

SHA256
1d88b00e13f2bf5e3e8a6b10f7f49e01b5e49a72c5216294a404e2b1f01b39c6

SHA512
b0c8e5742ff064294f2bff4157c7c44bf347313e153c9fc54c7970259ada6094e78b25917e020c60d7982640aaa7cd83deeb57f9311bc62ad2f21d65357cfd90

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
c68bc92c3f3f1825481830062cec93d9

SHA1
51490e1516c9c3e8b6911073cd818a767c7a8021

SHA256
a3b38125558bd162e6416c97b56f169c432f18dd5b96dc43f3200c6010993585

SHA512
f0f5d348f6be75ccc631958a04e375a4554364d081ad81bfbf65c9e8c32bdbb82a8b9232e24786539b2fb7ed829fb40a4603fe0fbb0368a968d1087330e35c33

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
e50ce7645d965bc80eb6bed72facc11c

SHA1
4c2b39f677a82c4adbbe1afefc5d77d2581b2159

SHA256
63bed07ea1acbb2b95fd8614759c914a59362226e04fd04603913607f75b2133

SHA512
cd2cd152e62e37d820dc3d9513d382c9304baa7958342ffe2cfc3ff4f091d382dfeb6473048e7b6bad424b04f61980cce6766615874acefa11d0a8f981532edb

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
513e46c05ba8cf18cf37c05b63d2c1b0

SHA1
2db39a5fc1908a1a0146fcc210832a7fed654270

SHA256
ca9e0aad4818848b0effbb6d4259eb50f36231406fbbe25287377b42040d6fbe

SHA512
2e10fdb44ec549b3b06ad4d67675d7b72f8ff4f58abdc6a3531282addafa46ec632018dfbfdb9013dee3867f3d45ea8ae12e3af53a259d6d092204bcbfd6a3c7

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
ad8dd31632d6a1718bf835b345bf0d94

SHA1
9fed820296d14abd79321cfb31139d76e893fe89

SHA256
27ecd1906b95ebeb3dfee7a7c9e0b57153b2a18ad554b3e8ddfd7ba3c7e5bc51

SHA512
50fddbdbba8b26a77cadb614590a39121f95815506d402cc9669ca964688ef4df8abf8b8981162364c55d75b0417b94c91ab3104863537d2340527154a099da0

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
d2be8dd0b34d42c8e8b49c4b74110307

SHA1
d0ff50897096dd1096ec236ccb90f5433c297529

SHA256
0840490f7046e025ac123a649f87be4a0c8b5c3f5ab076fa3990c24614e7f764

SHA512
e6c844e90852e22e89748490a19972cb3dff5a258fd527b6b1ea95bf28cf98a4a4987bbd34ae5f427dbd3e09b274711645e764002de5db5772d3de62e840ec65

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
98e1d53eb4cafc8241d00f3014992e95

SHA1
ff173aea8d0e7f931646b03c3357c6d9ef52f025

SHA256
63c74213508ad015676cf61747ffeea770331bc6c82af7606b73974b5457bcbd

SHA512
a1a3a4f94b4631f40d297ca4f848592728e632515f29432addb63ff2d037a8693c47bc647772142b477d4abb909bbf8fd603daa1d73efa26eb406e602c63b8de

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
49fe315d802bece913af65f0964da447

SHA1
9ae2601b294c19866b6e8e6478d2a3fa2d39c9a9

SHA256
ae87d498dd9d010e64075796d546703403afcca10cd314825e0739021edf459b

SHA512
b685b664f35d9d6bdbdbd276540134caab2edf9c25bfef0f5a67c35831be8409fa8c44bd1783c3ef90d6a37fecc562d7330dff438f309cb97355c890ee26fa61

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
b945c421ac030fe054a43f9e88176bfd

SHA1
5632e1ec25d342413663c6a4a104dca7f93e84b8

SHA256
ed41e9dd98910fabd2dc477834c71070e181032fdbbdfe825fccaab038ee9fbf

SHA512
a621c82c15d566de1815876bed71badf6823a9739a0e4d2100008e7f43d9b341c8ae9d38b887fbb73ce1e24f68cc74e4ad7af82170c5c5fdaf297de1e937d365

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
f75a7ffe33725714e0a24f562889942c

SHA1
e19077359a762d7991bd4720e8e80e8c0e521be7

SHA256
8c5bc331a699a2b1370be04b681c21c0af34ef63cd4d9dc50cc226a3c5284dc8

SHA512
250bd59120c16c0b173290d31b9fa0644cf55fde5724aff68990006f0f07bfb6c6879aff21cc29d82725e0fbd04f926adc18c4d58899e6943025344a3aa44e45

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
ec3e12293b04b8c708e8a16567cfd341

SHA1
30edbf949684572bee9aac4ab4741883b1c1ec84

SHA256
43c9ddee8c8ad94fc58018f5a907614d7d744a6a9d0b108b70732610c2480ed5

SHA512
76dbc88149fd603d3872149300d6a38b1d91d6942d89244fffc9ab79b7452fd5221f1a5947c2813299a4a5f59a795ccb6fbb7a780cca56c97cf3d02fa03a7811

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
a0dce4fde319c590b5f99f798bc029bc

SHA1
222fc554176ec0b0d4cbea9fa906ef287fc656a5

SHA256
0bfef847d3716875383fb5b1efa42be7d4c1035479ab8717dc09ac53e8058253

SHA512
7a7bdbc948333c52cf79f4542513abeeae316c17af948e66328f122bf2c6bf179f50dae95e1d1e14d320faa81d596b4b450abf578899c62b4ccd591e1279f37d

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
77efbffbfdad4f6537bb4d779952798c

SHA1
bb69e885982789e7f4d2f619e1c2cfebc762c02f

SHA256
f9b18b0a109affc139343e097e36fa2ea10fa8ef27a26167610addf959ddb0a2

SHA512
7091f543262597cc5ef78448cfded9b7a2fb3be4b00cda8919e3a55a6ea1a6f0066b00c3bb734077a753781ca54f794bbdca8a29c054991c2c284fe45e4d0d2c

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
7bf11af1e0968086715120fb2df476bf

SHA1
85febe307702dda763916324753ba239c451f554

SHA256
60d0ad9b78c1a0ae823915779410723c9b90270a83c498df5434ede041397292

SHA512
17c4526c02693fabc11dd41d145ef45921f4782d3a4a38d78b8f1c892c35622a742ebe78a7fbdf635d88376d140f224d9dc63aff6a3ee039795bb3a46c2fa4cd

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
2108e286828127dcadc453efc07f0f1c

SHA1
a2a2c1a105e1f44e47999039e326050d3ce1c13b

SHA256
b333fd560631068799a8ad92e5a4ebe896e64567dc84e964b0bd59d7f7bdc77a

SHA512
0e34471b80f0f2246c77327c1ea40e8ae5608d94dc155f670e122a56324229d20f00faabfddf1d138044476c01e2f2f3d941930327369921a5e78181043df8e4

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
513dcd90b3d148a4c7de5f991ea9d870

SHA1
3ce994204e71a97217e06cc1e44e5d0174345b62

SHA256
18856b5af6948bdf2aa0b0728bbc75eef6045e6a0f1a2a1a7dc91211c4071c09

SHA512
ea1ca7d491204536477bb45aee1abad19d0408a20ec8cb4f23752d498c5280d5392ed4e57f3bfa7b23b4a8072a98bb7ad5cf03a8bad8cef4803f3bded0618b1f

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
db207feb6fd976fd1e4ba304914830ff

SHA1
fd620eb0a6b4a54a4a187ef1eddc0345e272bce3

SHA256
6d70aabc238e9d9e4b384919c3b14d63681b4a3a271f6a881e3e4f780e650a25

SHA512
a8b5f09167a5fbbc435109a3b5410c68d711c0a4692b580acbe050e74b3498e240051aa6db68c286edcf44fc897292d131997c6e89694ad7f3ccb81e70ae0bc2

Download Submit
C:\ProgramData\TEMP:3DAA471A

Filesize
125B

MD5
15e9ec27aed997dadbe35295fccc2d27

SHA1
2d05752b25aeb95d4bccae785387e22cf4192101

SHA256
9a53058efc7dcf6e7957ac1dc2f0d79de68e876544f7bf4d5c557e13740202b0

SHA512
cc6955d5781cd1846f697de482bcbf0cd01c462ab259ba28f92cc087a1e3907b9994f8d4ae30173c386091afea600af174f978d299f5e8a9e00adfe7e0f4614c

Download Submit
C:\Windows\SysWOW64\gykhptx.exe

Filesize
792KB

MD5
f7a1a4ec8ee1f0504378264b77c200cf

SHA1
afafcaff5c683e70324298d6fe75fdbaba506296

SHA256
6d1d41b1f4df5c76e9f8a82469471cc9eb623c08fda2be0554c3e20ccd775af1

SHA512
d6d1c8d8775d8d6c52548f8765200320d79ffe01948ec5629c961b227bd8024ff7dfeb9c0610797cbebed845eab3cbfe5096bbaf6e43e6719192c07e6aceb174

Download Submit
memory/116-1174-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/228-544-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/312-810-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/452-567-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/704-709-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/756-208-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/760-617-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/956-1240-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/960-851-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/968-403-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1104-1217-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1116-1263-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1244-1037-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1248-1102-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1372-235-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1392-114-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1392-106-0x0000000002200000-0x0000000002294000-memory.dmp

Filesize
592KB

Download
memory/1392-115-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1392-146-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1392-118-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1392-117-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1464-452-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1480-1010-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1664-1055-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1696-1166-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1732-1082-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1956-343-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2016-917-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2132-943-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2316-686-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2456-757-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-60-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-53-0x0000000002250000-0x00000000022E4000-memory.dmp

Filesize
592KB

Download
memory/2776-61-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-62-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-58-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-57-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-47-0x0000000002250000-0x00000000022E4000-memory.dmp

Filesize
592KB

Download
memory/2776-63-0x0000000002250000-0x00000000022E4000-memory.dmp

Filesize
592KB

Download
memory/2776-51-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-89-0x0000000002250000-0x00000000022E4000-memory.dmp

Filesize
592KB

Download
memory/2776-88-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2956-599-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3004-475-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3124-1134-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3276-530-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3324-181-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3328-1309-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3376-640-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3564-1285-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3568-864-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3696-289-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3816-501-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3832-824-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-11-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-0-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-12-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-9-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-13-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-28-0x0000000000870000-0x0000000000904000-memory.dmp

Filesize
592KB

Download
memory/3944-14-0x0000000000870000-0x0000000000904000-memory.dmp

Filesize
592KB

Download
memory/3944-8-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3944-7-0x0000000000870000-0x0000000000904000-memory.dmp

Filesize
592KB

Download
memory/3944-2-0x0000000000870000-0x0000000000904000-memory.dmp

Filesize
592KB

Download
memory/3968-34-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3968-38-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3968-30-0x0000000000890000-0x0000000000924000-memory.dmp

Filesize
592KB

Download
memory/3968-69-0x0000000000890000-0x0000000000924000-memory.dmp

Filesize
592KB

Download
memory/3968-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3968-40-0x0000000000890000-0x0000000000924000-memory.dmp

Filesize
592KB

Download
memory/3968-23-0x0000000000890000-0x0000000000924000-memory.dmp

Filesize
592KB

Download
memory/3968-39-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3968-22-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3968-70-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3968-35-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3992-262-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4012-778-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4264-360-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4396-732-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4496-956-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4544-593-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-93-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-97-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-126-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-77-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-80-0x00000000021C0000-0x0000000002254000-memory.dmp

Filesize
592KB

Download
memory/4684-98-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-99-0x00000000021C0000-0x0000000002254000-memory.dmp

Filesize
592KB

Download
memory/4780-663-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4788-306-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4856-857-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4856-897-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4904-945-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4904-991-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4908-1197-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5108-425-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download