metasploit | dd1b98a578d4c4dac4064b9849630878b95fe9e06a8eb141c8612e660caeacee

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe
Size

693KB
MD5

e99f6ab90c467e6f67379912be367664
SHA1

a2236b36e18c46941051590ecbc2f9b81089e7bb
SHA256

dd1b98a578d4c4dac4064b9849630878b95fe9e06a8eb141c8612e660caeacee
SHA512

9718c7d0eecf1f1cd843a59554193857fd9fe8edf23c77f046c9b6f1453ce570a76ebce715ca69ca4268c168d7f4771c97a6163cf07f2e1cc6f0f60217079a89
SSDEEP

12288:FayriPUR51b9eX7Gy569idYRYJW1VDjrmAkx:FayrisR51ReX7Go/Ed7jrmd

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Checks BIOS information in registry 2 TTPs 64 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hpwqhsfoxig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pkynerfppay.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	pshooofuaap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	whmfhgdeqmr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	jsdophovlcd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mroeiyxogoa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vbpswhaakbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	lxjjqlfoztu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fafgthxdtlu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	bwrltxlfnva.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	nabgokeazwr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	zrursnkudwt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ybuzcoqyvnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	rzfxojpqivj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmjeauteybr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wuzccursnvf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	iplunwycpjr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fsqjkjkdwtt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pcgwwqfnzzm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	pcgwwqfnzzm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	zdqioyrhopb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	qlxvesiqfkf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wslhkflchcx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	prbosvhohlr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ezoatksmdpu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	niozfaktzic.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	robvxwpakfn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	nbloletiemu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	jxlqhmryyxn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	xdathwbpyao.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	jnqrgqyiwnd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	psxypmbfzcz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vgzujikmgur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	nppsrhoiawt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	qapferysnrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	pntzaggyxxb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	qapferysnrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	zgsxkvviwvt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ihborabfjlb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	gaxarnpwpjc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	deeofijqbwh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	pagwuuvmugp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	youaqpqxozb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ljuixemlnsr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	njjqfklavcd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	clrmpdqzgfl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	jvqodltpand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	kcpiyictzrq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	cgflktyuwoy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	zkznwpnjttn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	egpjkvibhdt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	gtkivowmfmj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vxpqdpbxjip.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vyheuriyuzo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	uxgfdfbbzku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dqvijxiyfip.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tihbhhtmuox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lwbzybgtlwy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	poziackdagb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	xatgaubashk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	rqmvynfsfbx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vidcgmhgzae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	tunnqujgdap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nabgokeazwr.exe

Executes dropped EXE 64 IoCs

pid	Process
3104	nslbrpoebvh.exe
2276	anbgqwiopmm.exe
3504	fojbgtgcxaf.exe
1804	fahfmzxohcv.exe
3024	cqpdsssdrwm.exe
1444	fxenisthlqv.exe
60	psxypmbfzcz.exe
3664	zoyifhckmfc.exe
4548	fmcykabnhnv.exe
2020	nbqlwkzgvko.exe
5000	soktpmloplz.exe
4444	xxqwsmdzjxl.exe
3528	xqromgnqxrm.exe
556	sokzibnbsta.exe
2388	nflcfywwtph.exe
3540	unzurnyotzc.exe
3320	ixfeumyzvlo.exe
3376	unahdndgnyb.exe
2744	slhheuinois.exe
2008	aavuhwogcft.exe
2432	zsdfkrpwqqm.exe
4572	kowxrlyuecp.exe
1512	slskvovnsqr.exe
116	aerlkcziaal.exe
3680	puctqmvxtbh.exe
4948	seuijidvair.exe
4568	xrnqcspdvjc.exe
1496	zlqoofsfcrk.exe
2652	ktdlzerecpo.exe
1036	xcbocdrpwba.exe
2840	hfzmbgdilke.exe
5096	cwthyvfdnhl.exe
2452	prleezdqbgx.exe
4632	clrmpdqzgfl.exe
1412	mdgruukuhdo.exe
4748	pjnujttycqx.exe
3976	rtmsbhbxjpz.exe
1940	eshuspyejcm.exe
1360	pnifakhbxnp.exe
3596	aumxcwcklya.exe
4484	hywktpfzyvu.exe
5088	mlqsershsdf.exe
4000	sxknpnkrbrx.exe
4388	utcgxitoocb.exe
5032	biyyrfugomw.exe
3960	kymlviazkbx.exe
4592	rqkljowmklr.exe
3184	xatgaubashk.exe
1260	mimogdfplhy.exe
532	rrujpjlvtdq.exe
2592	weorisqdnec.exe
3892	cblzwuxoamu.exe
4888	bqjencadclu.exe
2000	kclmoaytdun.exe
1796	eabhryftdjv.exe
1888	owcsysoyruy.exe
2604	miynxvmcfrp.exe
2480	zdqioyrhopb.exe
4464	xpmdebxlumr.exe
996	rggybqhodig.exe
4416	rvddtgkcxhg.exe
4064	cntjfwmfyfj.exe
1628	jsdophovlcd.exe
1720	wmjeauteybr.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dqvijxiyfip.exe	nxyvzkghzva.exe
File opened for modification	C:\Windows\SysWOW64\hnpwrqurnug.exe	zuqwkjrwmkn.exe
File opened for modification	C:\Windows\SysWOW64\sxknpnkrbrx.exe	mlqsershsdf.exe
File created	C:\Windows\SysWOW64\ejgswtydxyk.exe	ukcuevqdxag.exe
File opened for modification	C:\Windows\SysWOW64\uoqygcewbww.exe	vvpompufvkd.exe
File created	C:\Windows\SysWOW64\xkdcbnuxbhg.exe	nhfrgkgvpwc.exe
File created	C:\Windows\SysWOW64\jqrwvhyskps.exe	edypcylkqgh.exe
File opened for modification	C:\Windows\SysWOW64\tkxjkewucnf.exe	gaqzheekjtt.exe
File opened for modification	C:\Windows\SysWOW64\dvzyhypbeha.exe	iauipfhwqys.exe
File opened for modification	C:\Windows\SysWOW64\zdwjdtkhtde.exe	pivrwyjjfsa.exe
File opened for modification	C:\Windows\SysWOW64\wnrxapxqfzv.exe	pfdxoaoggpa.exe
File created	C:\Windows\SysWOW64\rtmsbhbxjpz.exe	pjnujttycqx.exe
File created	C:\Windows\SysWOW64\jfqbfzbasfu.exe	okllfgtdevm.exe
File opened for modification	C:\Windows\SysWOW64\deeofijqbwh.exe	qcxtiwzptzv.exe
File created	C:\Windows\SysWOW64\vmqrqnsvede.exe	qswwnzsmvhm.exe
File opened for modification	C:\Windows\SysWOW64\wslhkflchcx.exe	vpypvbhiarx.exe
File created	C:\Windows\SysWOW64\fkhygdlfnbk.exe	sppibzeazbx.exe
File opened for modification	C:\Windows\SysWOW64\jsdophovlcd.exe	cntjfwmfyfj.exe
File created	C:\Windows\SysWOW64\kpnwcgaffqb.exe	aumevmaisfp.exe
File created	C:\Windows\SysWOW64\aeybocvtvnn.exe	mroeiyxogoa.exe
File created	C:\Windows\SysWOW64\oalmcpngvgo.exe	pikciddppun.exe
File created	C:\Windows\SysWOW64\vezjsicmkof.exe	vmqrqnsvede.exe
File opened for modification	C:\Windows\SysWOW64\uylanzayytt.exe	ujnuwqxkeub.exe
File created	C:\Windows\SysWOW64\zxmjqlcxqcc.exe	oqamymuxqey.exe
File created	C:\Windows\SysWOW64\lgozonzcwqc.exe	dfphagvhogi.exe
File opened for modification	C:\Windows\SysWOW64\sppibzeazbx.exe	nkeahxasntm.exe
File created	C:\Windows\SysWOW64\xgqjnbqdmwh.exe	pcgwwqfnzzm.exe
File opened for modification	C:\Windows\SysWOW64\nflcfywwtph.exe	sokzibnbsta.exe
File opened for modification	C:\Windows\SysWOW64\vpypvbhiarx.exe	lxjjqlfoztu.exe
File created	C:\Windows\SysWOW64\sppibzeazbx.exe	nkeahxasntm.exe
File opened for modification	C:\Windows\SysWOW64\kcwqgeznjci.exe	fezasdajwby.exe
File created	C:\Windows\SysWOW64\xaamzbfhvpn.exe	snhegzazboc.exe
File created	C:\Windows\SysWOW64\anbgqwiopmm.exe	nslbrpoebvh.exe
File opened for modification	C:\Windows\SysWOW64\seuijidvair.exe	puctqmvxtbh.exe
File created	C:\Windows\SysWOW64\afdctuoeuki.exe	yvlnbyggnky.exe
File opened for modification	C:\Windows\SysWOW64\dqvijxiyfip.exe	nxyvzkghzva.exe
File created	C:\Windows\SysWOW64\tihbhhtmuox.exe	lexoxwqxizd.exe
File opened for modification	C:\Windows\SysWOW64\nhtkabamjjd.exe	ggmktuwqbzb.exe
File created	C:\Windows\SysWOW64\snhegzazboc.exe	faxoavbmvop.exe
File created	C:\Windows\SysWOW64\jbjzlhdxztd.exe	rbgcmbzkqtg.exe
File opened for modification	C:\Windows\SysWOW64\dbnfmvpbdax.exe	ydqxyuqpprf.exe
File created	C:\Windows\SysWOW64\mksrjglhnie.exe	jelguokdtwu.exe
File opened for modification	C:\Windows\SysWOW64\gaqzheekjtt.exe	gtttqwtvhvt.exe
File opened for modification	C:\Windows\SysWOW64\ujnuwqxkeub.exe	zgsxkvviwvt.exe
File opened for modification	C:\Windows\SysWOW64\rlmcfmgqepz.exe	mnhmzlzerop.exe
File opened for modification	C:\Windows\SysWOW64\wbvdqyujeoy.exe	robvxwpakfn.exe
File opened for modification	C:\Windows\SysWOW64\vjovbksxmkf.exe	feoaxfvkfxk.exe
File opened for modification	C:\Windows\SysWOW64\fxbbctqtjxa.exe	shgytlklqkn.exe
File created	C:\Windows\SysWOW64\qtnxiieqaqc.exe	nnzmtqcugdt.exe
File opened for modification	C:\Windows\SysWOW64\fahfmzxohcv.exe	fojbgtgcxaf.exe
File created	C:\Windows\SysWOW64\unzurnyotzc.exe	nflcfywwtph.exe
File opened for modification	C:\Windows\SysWOW64\yevqcvnluic.exe	jdllysbchkk.exe
File created	C:\Windows\SysWOW64\zenqwaitrxo.exe	rozdlxlawin.exe
File opened for modification	C:\Windows\SysWOW64\jfqhypzgymr.exe	cbgugewilxx.exe
File created	C:\Windows\SysWOW64\xpmdebxlumr.exe	zdqioyrhopb.exe
File opened for modification	C:\Windows\SysWOW64\ymbgqvwnhbg.exe	toeqcuxkmtv.exe
File created	C:\Windows\SysWOW64\dbnfmvpbdax.exe	ydqxyuqpprf.exe
File created	C:\Windows\SysWOW64\zseuyvbhgpl.exe	uylanzayytt.exe
File created	C:\Windows\SysWOW64\zdqioyrhopb.exe	miynxvmcfrp.exe
File opened for modification	C:\Windows\SysWOW64\fqfvchpdffi.exe	vrtpkjidfhe.exe
File created	C:\Windows\SysWOW64\cwgtsiypikx.exe	ragaknqsuzt.exe
File opened for modification	C:\Windows\SysWOW64\jwdxmemoohd.exe	bhpkabpvasc.exe
File opened for modification	C:\Windows\SysWOW64\sscssupdjwm.exe	dzfxiymldbp.exe
File opened for modification	C:\Windows\SysWOW64\aerlkcziaal.exe	slskvovnsqr.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seuijidvair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaxarnpwpjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fmcykabnhnv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpvcmlzzsll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fuyhupoagsr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emyqelvdtbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wufbvsbrfyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwxzsyysymk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qgjvafjcvku.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ppzfkrnnstm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xatgaubashk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pikciddppun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tunnqujgdap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aavuhwogcft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukcuevqdxag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whmfhgdeqmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vnwoukrzfvv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfqhypzgymr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mimogdfplhy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rrujpjlvtdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhmllhwozvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mwtacmlcdxp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wbvdqyujeoy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpekvzhwdtt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nblyqaujuss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xytejzwmokd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpxvifhxtks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yevqcvnluic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lphigofaotd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntpjzqgqedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfphagvhogi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	udyuwmsaetm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cqpdsssdrwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cojaadmnmde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuqwkjrwmkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uiyqlizejqv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	swlhxypfuli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jnglvrtqtoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsxroidlmhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rozdlxlawin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zjhwrruazzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hywktpfzyvu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qswwnzsmvhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pshooofuaap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bnmnvnrjqfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppibzeazbx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aumxcwcklya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wzovrwlwpkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deeofijqbwh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	augabhgwwce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlmcfmgqepz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sscssupdjwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uvfpnmfpdbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grojnapmdia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ptcyqutnrrz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iqviwvmjhnt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hirhpkgvtcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoydbczkjfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nabgokeazwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exycrxfpapw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtkwubomrpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmuuzweuazi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qfpgtwdlyxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bhjmhjosyuz.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFeeWfn"	sxknpnkrbrx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhra	mhmllhwozvw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhra	qmmhusbmygu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi\ = "UN}hzIuJLQMl{h^SHX"	uoqygcewbww.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFeyGvn"	wmuuzweuazi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi\ = "UN}k@IeJLQMl{h^SHX"	bwrltxlfnva.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO\x7f_Kd@@"	dfphagvhogi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi\ = "UN}jFIuJLQMl{h^SHX"	unzurnyotzc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sfENDkm	upvsntggneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\hyrhvbVvokz\ = "~\|RI\\o_]jzPg{z_jDSz"	gtrmggkeied.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AcAXhb"	cwthyvfdnhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AaCXhb"	ihborabfjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO\|eGAeu"	pkynerfppay.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk	bwovdrxjwpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sfENDkm\ = "zaUEpCuKMy\|uag~obEio}NBCz"	rhamgmrmfyw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO\|o~veI"	dawytfvhvma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO\|iGw{x"	bhpkabpvasc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\hyrhvbVvokz\ = "~\|RI\\o_]jzPg{z_jDSz"	iahmjsbilje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO}usYjj"	pvsspfcerte.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi\ = "UN}j\\IuJLQMl{h^SHX"	fxenisthlqv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AbsXhb"	mhmllhwozvw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhra\ = "_YoLQvmCDNaXgnPZl"	wuzccursnvf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AaPXhb"	nzobftrvloa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\hyrhvbVvokz\ = "~\|RI\\o_]jzPg{z_jDSz"	jnqrgqyiwnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO}rXxv["	jdllysbchkk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}	gunxangawlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@A`KXhb"	zuqwkjrwmkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFeYgfn"	aerlkcziaal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhra\ = "_YoLQvmCDNaXgnPZl"	rtmsbhbxjpz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AcTXhb"	eabhryftdjv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sfENDkm	rpkjosvlyzh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@Aa]Xhb"	nabgokeazwr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah	mzxfuismnli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFesGjn"	zrursnkudwt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sfENDkm\ = "zaUEpCuKMy\|uag~obEio}NBCz"	ejuwqgkotjw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFe{wvn"	wtkwubomrpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFeDgfn"	soktpmloplz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg	niozfaktzic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO\|S@f`\\"	nblyqaujuss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFe\|Gvn"	jrdbxpmljsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO\x7fS\|pJ_"	udyuwmsaetm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sfENDkm	kymlviazkbx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}	qswwnzsmvhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AboXxb"	dvnhnlhfuqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\hyrhvbVvokz\ = "~\|RI\\o_]jzPg{z_jDSz"	aeybocvtvnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi\ = "UN}i_IeJLQMl{h^SHX"	pnodkxtdlor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@A`oXxb"	evygfgrakqo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}	tiqrwpwgzdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi\ = "UN}hOIuJLQMl{h^SHX"	dqvijxiyfip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhra\ = "_YoLQvmCDNaXgnPZl"	ujnuwqxkeub.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi	uwagnegozvy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg	mroeiyxogoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFe@gfn"	nflcfywwtph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AcpXhb"	slhheuinois.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\djwgah\ = "}~aRtD{rB}j{gGIQ@rmvdw[dsFeXwnn"	iohnfxcbxbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi	shgytlklqkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sfENDkm\ = "zaUEpCuKMy\|uag~obEio}NBCz"	sppibzeazbx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO~yOf^N"	snhegzazboc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\yhlqdsabvi\ = "UN}jgIuJLQMl{h^SHX"	rrujpjlvtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}	zxmjqlcxqcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\xfzdxqKjzdg\ = "iO}\x7fRjp_"	rlmcfmgqepz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AbFXxb"	yskgzsnktbz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\sMmtisoqk\ = "uEzKX\|gp\|r\|GSU@b[zOWKen@AbZXxb"	vjovbksxmkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\hyrhvbVvokz\ = "~\|RI\\o_]jzPg{z_jDSz"	xpivryqowad.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1932	e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1932	e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe
Token: 33	3104	nslbrpoebvh.exe
Token: SeIncBasePriorityPrivilege	3104	nslbrpoebvh.exe
Token: 33	2276	anbgqwiopmm.exe
Token: SeIncBasePriorityPrivilege	2276	anbgqwiopmm.exe
Token: 33	3504	fojbgtgcxaf.exe
Token: SeIncBasePriorityPrivilege	3504	fojbgtgcxaf.exe
Token: 33	1804	fahfmzxohcv.exe
Token: SeIncBasePriorityPrivilege	1804	fahfmzxohcv.exe
Token: 33	3024	cqpdsssdrwm.exe
Token: SeIncBasePriorityPrivilege	3024	cqpdsssdrwm.exe
Token: 33	1444	fxenisthlqv.exe
Token: SeIncBasePriorityPrivilege	1444	fxenisthlqv.exe
Token: 33	60	psxypmbfzcz.exe
Token: SeIncBasePriorityPrivilege	60	psxypmbfzcz.exe
Token: 33	3664	zoyifhckmfc.exe
Token: SeIncBasePriorityPrivilege	3664	zoyifhckmfc.exe
Token: 33	4548	fmcykabnhnv.exe
Token: SeIncBasePriorityPrivilege	4548	fmcykabnhnv.exe
Token: 33	2020	nbqlwkzgvko.exe
Token: SeIncBasePriorityPrivilege	2020	nbqlwkzgvko.exe
Token: 33	5000	soktpmloplz.exe
Token: SeIncBasePriorityPrivilege	5000	soktpmloplz.exe
Token: 33	4444	xxqwsmdzjxl.exe
Token: SeIncBasePriorityPrivilege	4444	xxqwsmdzjxl.exe
Token: 33	3528	xqromgnqxrm.exe
Token: SeIncBasePriorityPrivilege	3528	xqromgnqxrm.exe
Token: 33	556	sokzibnbsta.exe
Token: SeIncBasePriorityPrivilege	556	sokzibnbsta.exe
Token: 33	2388	nflcfywwtph.exe
Token: SeIncBasePriorityPrivilege	2388	nflcfywwtph.exe
Token: 33	3540	unzurnyotzc.exe
Token: SeIncBasePriorityPrivilege	3540	unzurnyotzc.exe
Token: 33	3320	ixfeumyzvlo.exe
Token: SeIncBasePriorityPrivilege	3320	ixfeumyzvlo.exe
Token: 33	3376	unahdndgnyb.exe
Token: SeIncBasePriorityPrivilege	3376	unahdndgnyb.exe
Token: 33	2744	slhheuinois.exe
Token: SeIncBasePriorityPrivilege	2744	slhheuinois.exe
Token: 33	2008	aavuhwogcft.exe
Token: SeIncBasePriorityPrivilege	2008	aavuhwogcft.exe
Token: 33	2432	zsdfkrpwqqm.exe
Token: SeIncBasePriorityPrivilege	2432	zsdfkrpwqqm.exe
Token: 33	4572	kowxrlyuecp.exe
Token: SeIncBasePriorityPrivilege	4572	kowxrlyuecp.exe
Token: 33	1512	slskvovnsqr.exe
Token: SeIncBasePriorityPrivilege	1512	slskvovnsqr.exe
Token: 33	116	aerlkcziaal.exe
Token: SeIncBasePriorityPrivilege	116	aerlkcziaal.exe
Token: 33	3680	puctqmvxtbh.exe
Token: SeIncBasePriorityPrivilege	3680	puctqmvxtbh.exe
Token: 33	4948	seuijidvair.exe
Token: SeIncBasePriorityPrivilege	4948	seuijidvair.exe
Token: 33	4568	xrnqcspdvjc.exe
Token: SeIncBasePriorityPrivilege	4568	xrnqcspdvjc.exe
Token: 33	1496	zlqoofsfcrk.exe
Token: SeIncBasePriorityPrivilege	1496	zlqoofsfcrk.exe
Token: 33	2652	ktdlzerecpo.exe
Token: SeIncBasePriorityPrivilege	2652	ktdlzerecpo.exe
Token: 33	1036	xcbocdrpwba.exe
Token: SeIncBasePriorityPrivilege	1036	xcbocdrpwba.exe
Token: 33	2840	hfzmbgdilke.exe
Token: SeIncBasePriorityPrivilege	2840	hfzmbgdilke.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3104	1932	e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe	83
PID 1932 wrote to memory of 3104	1932	e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe	83
PID 1932 wrote to memory of 3104	1932	e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe	83
PID 3104 wrote to memory of 2276	3104	nslbrpoebvh.exe	84
PID 3104 wrote to memory of 2276	3104	nslbrpoebvh.exe	84
PID 3104 wrote to memory of 2276	3104	nslbrpoebvh.exe	84
PID 2276 wrote to memory of 3504	2276	anbgqwiopmm.exe	85
PID 2276 wrote to memory of 3504	2276	anbgqwiopmm.exe	85
PID 2276 wrote to memory of 3504	2276	anbgqwiopmm.exe	85
PID 3504 wrote to memory of 1804	3504	fojbgtgcxaf.exe	86
PID 3504 wrote to memory of 1804	3504	fojbgtgcxaf.exe	86
PID 3504 wrote to memory of 1804	3504	fojbgtgcxaf.exe	86
PID 1804 wrote to memory of 3024	1804	fahfmzxohcv.exe	87
PID 1804 wrote to memory of 3024	1804	fahfmzxohcv.exe	87
PID 1804 wrote to memory of 3024	1804	fahfmzxohcv.exe	87
PID 3024 wrote to memory of 1444	3024	cqpdsssdrwm.exe	88
PID 3024 wrote to memory of 1444	3024	cqpdsssdrwm.exe	88
PID 3024 wrote to memory of 1444	3024	cqpdsssdrwm.exe	88
PID 1444 wrote to memory of 60	1444	fxenisthlqv.exe	89
PID 1444 wrote to memory of 60	1444	fxenisthlqv.exe	89
PID 1444 wrote to memory of 60	1444	fxenisthlqv.exe	89
PID 60 wrote to memory of 3664	60	psxypmbfzcz.exe	90
PID 60 wrote to memory of 3664	60	psxypmbfzcz.exe	90
PID 60 wrote to memory of 3664	60	psxypmbfzcz.exe	90
PID 3664 wrote to memory of 4548	3664	zoyifhckmfc.exe	91
PID 3664 wrote to memory of 4548	3664	zoyifhckmfc.exe	91
PID 3664 wrote to memory of 4548	3664	zoyifhckmfc.exe	91
PID 4548 wrote to memory of 2020	4548	fmcykabnhnv.exe	94
PID 4548 wrote to memory of 2020	4548	fmcykabnhnv.exe	94
PID 4548 wrote to memory of 2020	4548	fmcykabnhnv.exe	94
PID 2020 wrote to memory of 5000	2020	nbqlwkzgvko.exe	95
PID 2020 wrote to memory of 5000	2020	nbqlwkzgvko.exe	95
PID 2020 wrote to memory of 5000	2020	nbqlwkzgvko.exe	95
PID 5000 wrote to memory of 4444	5000	soktpmloplz.exe	96
PID 5000 wrote to memory of 4444	5000	soktpmloplz.exe	96
PID 5000 wrote to memory of 4444	5000	soktpmloplz.exe	96
PID 4444 wrote to memory of 3528	4444	xxqwsmdzjxl.exe	97
PID 4444 wrote to memory of 3528	4444	xxqwsmdzjxl.exe	97
PID 4444 wrote to memory of 3528	4444	xxqwsmdzjxl.exe	97
PID 3528 wrote to memory of 556	3528	xqromgnqxrm.exe	99
PID 3528 wrote to memory of 556	3528	xqromgnqxrm.exe	99
PID 3528 wrote to memory of 556	3528	xqromgnqxrm.exe	99
PID 556 wrote to memory of 2388	556	sokzibnbsta.exe	101
PID 556 wrote to memory of 2388	556	sokzibnbsta.exe	101
PID 556 wrote to memory of 2388	556	sokzibnbsta.exe	101
PID 2388 wrote to memory of 3540	2388	nflcfywwtph.exe	102
PID 2388 wrote to memory of 3540	2388	nflcfywwtph.exe	102
PID 2388 wrote to memory of 3540	2388	nflcfywwtph.exe	102
PID 3540 wrote to memory of 3320	3540	unzurnyotzc.exe	103
PID 3540 wrote to memory of 3320	3540	unzurnyotzc.exe	103
PID 3540 wrote to memory of 3320	3540	unzurnyotzc.exe	103
PID 3320 wrote to memory of 3376	3320	ixfeumyzvlo.exe	105
PID 3320 wrote to memory of 3376	3320	ixfeumyzvlo.exe	105
PID 3320 wrote to memory of 3376	3320	ixfeumyzvlo.exe	105
PID 3376 wrote to memory of 2744	3376	unahdndgnyb.exe	106
PID 3376 wrote to memory of 2744	3376	unahdndgnyb.exe	106
PID 3376 wrote to memory of 2744	3376	unahdndgnyb.exe	106
PID 2744 wrote to memory of 2008	2744	slhheuinois.exe	107
PID 2744 wrote to memory of 2008	2744	slhheuinois.exe	107
PID 2744 wrote to memory of 2008	2744	slhheuinois.exe	107
PID 2008 wrote to memory of 2432	2008	aavuhwogcft.exe	108
PID 2008 wrote to memory of 2432	2008	aavuhwogcft.exe	108
PID 2008 wrote to memory of 2432	2008	aavuhwogcft.exe	108
PID 2432 wrote to memory of 4572	2432	zsdfkrpwqqm.exe	109

C:\Users\Admin\AppData\Local\Temp\e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\nslbrpoebvh.exe
  C:\Windows\system32\nslbrpoebvh.exe 1312 "C:\Users\Admin\AppData\Local\Temp\e99f6ab90c467e6f67379912be367664_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\anbgqwiopmm.exe
    C:\Windows\system32\anbgqwiopmm.exe 1324 "C:\Windows\SysWOW64\nslbrpoebvh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\SysWOW64\fojbgtgcxaf.exe
      C:\Windows\system32\fojbgtgcxaf.exe 1436 "C:\Windows\SysWOW64\anbgqwiopmm.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Windows\SysWOW64\fahfmzxohcv.exe
        
        C:\Windows\system32\fahfmzxohcv.exe 1300 "C:\Windows\SysWOW64\fojbgtgcxaf.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1804
      - C:\Windows\SysWOW64\cqpdsssdrwm.exe
        
        C:\Windows\system32\cqpdsssdrwm.exe 1304 "C:\Windows\SysWOW64\fahfmzxohcv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\fxenisthlqv.exe
        
        C:\Windows\system32\fxenisthlqv.exe 1308 "C:\Windows\SysWOW64\cqpdsssdrwm.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\psxypmbfzcz.exe
        
        C:\Windows\system32\psxypmbfzcz.exe 1456 "C:\Windows\SysWOW64\fxenisthlqv.exe"
        8⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\zoyifhckmfc.exe
        
        C:\Windows\system32\zoyifhckmfc.exe 1452 "C:\Windows\SysWOW64\psxypmbfzcz.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\fmcykabnhnv.exe
        
        C:\Windows\system32\fmcykabnhnv.exe 1344 "C:\Windows\SysWOW64\zoyifhckmfc.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\nbqlwkzgvko.exe
        
        C:\Windows\system32\nbqlwkzgvko.exe 1236 "C:\Windows\SysWOW64\fmcykabnhnv.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\soktpmloplz.exe
        
        C:\Windows\system32\soktpmloplz.exe 1320 "C:\Windows\SysWOW64\nbqlwkzgvko.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\xxqwsmdzjxl.exe
        
        C:\Windows\system32\xxqwsmdzjxl.exe 1472 "C:\Windows\SysWOW64\soktpmloplz.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\xqromgnqxrm.exe
        
        C:\Windows\system32\xqromgnqxrm.exe 1364 "C:\Windows\SysWOW64\xxqwsmdzjxl.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\sokzibnbsta.exe
        
        C:\Windows\system32\sokzibnbsta.exe 1476 "C:\Windows\SysWOW64\xqromgnqxrm.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\nflcfywwtph.exe
        
        C:\Windows\system32\nflcfywwtph.exe 1328 "C:\Windows\SysWOW64\sokzibnbsta.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\unzurnyotzc.exe
        
        C:\Windows\system32\unzurnyotzc.exe 1356 "C:\Windows\SysWOW64\nflcfywwtph.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\ixfeumyzvlo.exe
        
        C:\Windows\system32\ixfeumyzvlo.exe 1492 "C:\Windows\SysWOW64\unzurnyotzc.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\unahdndgnyb.exe
        
        C:\Windows\system32\unahdndgnyb.exe 1488 "C:\Windows\SysWOW64\ixfeumyzvlo.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\slhheuinois.exe
        
        C:\Windows\system32\slhheuinois.exe 1512 "C:\Windows\SysWOW64\unahdndgnyb.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\aavuhwogcft.exe
        
        C:\Windows\system32\aavuhwogcft.exe 1500 "C:\Windows\SysWOW64\slhheuinois.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\zsdfkrpwqqm.exe
        
        C:\Windows\system32\zsdfkrpwqqm.exe 1348 "C:\Windows\SysWOW64\aavuhwogcft.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\kowxrlyuecp.exe
        
        C:\Windows\system32\kowxrlyuecp.exe 1340 "C:\Windows\SysWOW64\zsdfkrpwqqm.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4572
        
        C:\Windows\SysWOW64\slskvovnsqr.exe
        
        C:\Windows\system32\slskvovnsqr.exe 1520 "C:\Windows\SysWOW64\kowxrlyuecp.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
        
        C:\Windows\SysWOW64\aerlkcziaal.exe
        
        C:\Windows\system32\aerlkcziaal.exe 1516 "C:\Windows\SysWOW64\slskvovnsqr.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
        
        C:\Windows\SysWOW64\puctqmvxtbh.exe
        
        C:\Windows\system32\puctqmvxtbh.exe 1524 "C:\Windows\SysWOW64\aerlkcziaal.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
        
        C:\Windows\SysWOW64\seuijidvair.exe
        
        C:\Windows\system32\seuijidvair.exe 1560 "C:\Windows\SysWOW64\puctqmvxtbh.exe"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
        
        C:\Windows\SysWOW64\xrnqcspdvjc.exe
        
        C:\Windows\system32\xrnqcspdvjc.exe 1332 "C:\Windows\SysWOW64\seuijidvair.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
        
        C:\Windows\SysWOW64\zlqoofsfcrk.exe
        
        C:\Windows\system32\zlqoofsfcrk.exe 1528 "C:\Windows\SysWOW64\xrnqcspdvjc.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
        
        C:\Windows\SysWOW64\ktdlzerecpo.exe
        
        C:\Windows\system32\ktdlzerecpo.exe 1380 "C:\Windows\SysWOW64\zlqoofsfcrk.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\SysWOW64\xcbocdrpwba.exe
        
        C:\Windows\system32\xcbocdrpwba.exe 1536 "C:\Windows\SysWOW64\ktdlzerecpo.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
        
        C:\Windows\SysWOW64\hfzmbgdilke.exe
        
        C:\Windows\system32\hfzmbgdilke.exe 1544 "C:\Windows\SysWOW64\xcbocdrpwba.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
        
        C:\Windows\SysWOW64\cwthyvfdnhl.exe
        
        C:\Windows\system32\cwthyvfdnhl.exe 1376 "C:\Windows\SysWOW64\hfzmbgdilke.exe"
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\prleezdqbgx.exe
        
        C:\Windows\system32\prleezdqbgx.exe 1556 "C:\Windows\SysWOW64\cwthyvfdnhl.exe"
        34⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Windows\SysWOW64\clrmpdqzgfl.exe
        
        C:\Windows\system32\clrmpdqzgfl.exe 1548 "C:\Windows\SysWOW64\prleezdqbgx.exe"
        35⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\mdgruukuhdo.exe
        
        C:\Windows\system32\mdgruukuhdo.exe 1568 "C:\Windows\SysWOW64\clrmpdqzgfl.exe"
        36⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\pjnujttycqx.exe
        
        C:\Windows\system32\pjnujttycqx.exe 1396 "C:\Windows\SysWOW64\mdgruukuhdo.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\rtmsbhbxjpz.exe
        
        C:\Windows\system32\rtmsbhbxjpz.exe 1336 "C:\Windows\SysWOW64\pjnujttycqx.exe"
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3976
        
        C:\Windows\SysWOW64\eshuspyejcm.exe
        
        C:\Windows\system32\eshuspyejcm.exe 1576 "C:\Windows\SysWOW64\rtmsbhbxjpz.exe"
        39⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\pnifakhbxnp.exe
        
        C:\Windows\system32\pnifakhbxnp.exe 1584 "C:\Windows\SysWOW64\eshuspyejcm.exe"
        40⤵
        Executes dropped EXE
        
        PID:1360
        
        C:\Windows\SysWOW64\aumxcwcklya.exe
        
        C:\Windows\system32\aumxcwcklya.exe 1360 "C:\Windows\SysWOW64\pnifakhbxnp.exe"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Windows\SysWOW64\hywktpfzyvu.exe
        
        C:\Windows\system32\hywktpfzyvu.exe 1368 "C:\Windows\SysWOW64\aumxcwcklya.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\mlqsershsdf.exe
        
        C:\Windows\system32\mlqsershsdf.exe 1596 "C:\Windows\SysWOW64\hywktpfzyvu.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5088
        
        C:\Windows\SysWOW64\sxknpnkrbrx.exe
        
        C:\Windows\system32\sxknpnkrbrx.exe 1404 "C:\Windows\SysWOW64\mlqsershsdf.exe"
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\utcgxitoocb.exe
        
        C:\Windows\system32\utcgxitoocb.exe 1604 "C:\Windows\SysWOW64\sxknpnkrbrx.exe"
        45⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\biyyrfugomw.exe
        
        C:\Windows\system32\biyyrfugomw.exe 1600 "C:\Windows\SysWOW64\utcgxitoocb.exe"
        46⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\kymlviazkbx.exe
        
        C:\Windows\system32\kymlviazkbx.exe 1316 "C:\Windows\SysWOW64\biyyrfugomw.exe"
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\rqkljowmklr.exe
        
        C:\Windows\system32\rqkljowmklr.exe 1612 "C:\Windows\SysWOW64\kymlviazkbx.exe"
        48⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\xatgaubashk.exe
        
        C:\Windows\system32\xatgaubashk.exe 1620 "C:\Windows\SysWOW64\rqkljowmklr.exe"
        49⤵
        Checks BIOS information in registry
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3184
        
        C:\Windows\SysWOW64\mimogdfplhy.exe
        
        C:\Windows\system32\mimogdfplhy.exe 1624 "C:\Windows\SysWOW64\xatgaubashk.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\rrujpjlvtdq.exe
        
        C:\Windows\system32\rrujpjlvtdq.exe 1352 "C:\Windows\SysWOW64\mimogdfplhy.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\weorisqdnec.exe
        
        C:\Windows\system32\weorisqdnec.exe 1628 "C:\Windows\SysWOW64\rrujpjlvtdq.exe"
        52⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\cblzwuxoamu.exe
        
        C:\Windows\system32\cblzwuxoamu.exe 1616 "C:\Windows\SysWOW64\weorisqdnec.exe"
        53⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\bqjencadclu.exe
        
        C:\Windows\system32\bqjencadclu.exe 1636 "C:\Windows\SysWOW64\cblzwuxoamu.exe"
        54⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\kclmoaytdun.exe
        
        C:\Windows\system32\kclmoaytdun.exe 1372 "C:\Windows\SysWOW64\bqjencadclu.exe"
        55⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\eabhryftdjv.exe
        
        C:\Windows\system32\eabhryftdjv.exe 1420 "C:\Windows\SysWOW64\kclmoaytdun.exe"
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1796
        
        C:\Windows\SysWOW64\owcsysoyruy.exe
        
        C:\Windows\system32\owcsysoyruy.exe 1384 "C:\Windows\SysWOW64\eabhryftdjv.exe"
        57⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\miynxvmcfrp.exe
        
        C:\Windows\system32\miynxvmcfrp.exe 1652 "C:\Windows\SysWOW64\owcsysoyruy.exe"
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\zdqioyrhopb.exe
        
        C:\Windows\system32\zdqioyrhopb.exe 1648 "C:\Windows\SysWOW64\miynxvmcfrp.exe"
        59⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\xpmdebxlumr.exe
        
        C:\Windows\system32\xpmdebxlumr.exe 1660 "C:\Windows\SysWOW64\zdqioyrhopb.exe"
        60⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\rggybqhodig.exe
        
        C:\Windows\system32\rggybqhodig.exe 1668 "C:\Windows\SysWOW64\xpmdebxlumr.exe"
        61⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\rvddtgkcxhg.exe
        
        C:\Windows\system32\rvddtgkcxhg.exe 1432 "C:\Windows\SysWOW64\rggybqhodig.exe"
        62⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\cntjfwmfyfj.exe
        
        C:\Windows\system32\cntjfwmfyfj.exe 1664 "C:\Windows\SysWOW64\rvddtgkcxhg.exe"
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4064
        
        C:\Windows\SysWOW64\jsdophovlcd.exe
        
        C:\Windows\system32\jsdophovlcd.exe 1428 "C:\Windows\SysWOW64\cntjfwmfyfj.exe"
        64⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\wmjeauteybr.exe
        
        C:\Windows\system32\wmjeauteybr.exe 1672 "C:\Windows\SysWOW64\jsdophovlcd.exe"
        65⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\jvqodltpand.exe
        
        C:\Windows\system32\jvqodltpand.exe 1684 "C:\Windows\SysWOW64\wmjeauteybr.exe"
        66⤵
        Checks BIOS information in registry
        
        PID:1992
        
        C:\Windows\SysWOW64\joqzfgdggze.exe
        
        C:\Windows\system32\joqzfgdggze.exe 1388 "C:\Windows\SysWOW64\jvqodltpand.exe"
        67⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\pikciddppun.exe
        
        C:\Windows\system32\pikciddppun.exe 1400 "C:\Windows\SysWOW64\joqzfgdggze.exe"
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Windows\SysWOW64\oalmcpngvgo.exe
        
        C:\Windows\system32\oalmcpngvgo.exe 1700 "C:\Windows\SysWOW64\pikciddppun.exe"
        69⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\uvfpnmfpdbg.exe
        
        C:\Windows\system32\uvfpnmfpdbg.exe 1572 "C:\Windows\SysWOW64\oalmcpngvgo.exe"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Windows\SysWOW64\ukcuevqdxag.exe
        
        C:\Windows\system32\ukcuevqdxag.exe 1416 "C:\Windows\SysWOW64\uvfpnmfpdbg.exe"
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\ejgswtydxyk.exe
        
        C:\Windows\system32\ejgswtydxyk.exe 1708 "C:\Windows\SysWOW64\ukcuevqdxag.exe"
        72⤵
        
        PID:816
        
        C:\Windows\SysWOW64\gpvcmlzzsll.exe
        
        C:\Windows\system32\gpvcmlzzsll.exe 1704 "C:\Windows\SysWOW64\ejgswtydxyk.exe"
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
        
        C:\Windows\SysWOW64\hbxdnrxxbum.exe
        
        C:\Windows\system32\hbxdnrxxbum.exe 1480 "C:\Windows\SysWOW64\gpvcmlzzsll.exe"
        74⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\gbgvhehohgm.exe
        
        C:\Windows\system32\gbgvhehohgm.exe 1424 "C:\Windows\SysWOW64\hbxdnrxxbum.exe"
        75⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\oufvvllbhqg.exe
        
        C:\Windows\system32\oufvvllbhqg.exe 1444 "C:\Windows\SysWOW64\gbgvhehohgm.exe"
        76⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\zmvtabfeioj.exe
        
        C:\Windows\system32\zmvtabfeioj.exe 1392 "C:\Windows\SysWOW64\oufvvllbhqg.exe"
        77⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\ezoatksmdpu.exe
        
        C:\Windows\system32\ezoatksmdpu.exe 1460 "C:\Windows\SysWOW64\zmvtabfeioj.exe"
        78⤵
        Checks BIOS information in registry
        
        PID:3228
        
        C:\Windows\SysWOW64\jxlqhmryyxn.exe
        
        C:\Windows\system32\jxlqhmryyxn.exe 1736 "C:\Windows\SysWOW64\ezoatksmdpu.exe"
        79⤵
        Checks BIOS information in registry
        
        PID:3332
        
        C:\Windows\SysWOW64\rpkjosvlyzh.exe
        
        C:\Windows\system32\rpkjosvlyzh.exe 1412 "C:\Windows\SysWOW64\jxlqhmryyxn.exe"
        80⤵
        Modifies registry class
        
        PID:4996
        
        C:\Windows\SysWOW64\mhmllhwozvw.exe
        
        C:\Windows\system32\mhmllhwozvw.exe 1732 "C:\Windows\SysWOW64\rpkjosvlyzh.exe"
        81⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2644
        
        C:\Windows\SysWOW64\uhlmrwabhfp.exe
        
        C:\Windows\system32\uhlmrwabhfp.exe 1748 "C:\Windows\SysWOW64\mhmllhwozvw.exe"
        82⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\egpjkvibhdt.exe
        
        C:\Windows\system32\egpjkvibhdt.exe 1752 "C:\Windows\SysWOW64\uhlmrwabhfp.exe"
        83⤵
        Checks BIOS information in registry
        
        PID:2080
        
        C:\Windows\SysWOW64\ofbguupaicx.exe
        
        C:\Windows\system32\ofbguupaicx.exe 1756 "C:\Windows\SysWOW64\egpjkvibhdt.exe"
        84⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\ybuzcoqyvnb.exe
        
        C:\Windows\system32\ybuzcoqyvnb.exe 1280 "C:\Windows\SysWOW64\ofbguupaicx.exe"
        85⤵
        Checks BIOS information in registry
        
        PID:736
        
        C:\Windows\SysWOW64\lwlpikplbmn.exe
        
        C:\Windows\system32\lwlpikplbmn.exe 1764 "C:\Windows\SysWOW64\ybuzcoqyvnb.exe"
        86⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\mayhwwtfrxn.exe
        
        C:\Windows\system32\mayhwwtfrxn.exe 1468 "C:\Windows\SysWOW64\lwlpikplbmn.exe"
        87⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\rbgcmbzkqtg.exe
        
        C:\Windows\system32\rbgcmbzkqtg.exe 1532 "C:\Windows\SysWOW64\mayhwwtfrxn.exe"
        88⤵
        Drops file in System32 directory
        
        PID:3968
        
        C:\Windows\SysWOW64\jbjzlhdxztd.exe
        
        C:\Windows\system32\jbjzlhdxztd.exe 1508 "C:\Windows\SysWOW64\rbgcmbzkqtg.exe"
        89⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\upvsntggneg.exe
        
        C:\Windows\system32\upvsntggneg.exe 1780 "C:\Windows\SysWOW64\jbjzlhdxztd.exe"
        90⤵
        Modifies registry class
        
        PID:1884
        
        C:\Windows\SysWOW64\wwcddkhchrp.exe
        
        C:\Windows\system32\wwcddkhchrp.exe 1440 "C:\Windows\SysWOW64\upvsntggneg.exe"
        91⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\jqisoxllvyd.exe
        
        C:\Windows\system32\jqisoxllvyd.exe 1792 "C:\Windows\SysWOW64\wwcddkhchrp.exe"
        92⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\wzovrwlwpkp.exe
        
        C:\Windows\system32\wzovrwlwpkp.exe 1784 "C:\Windows\SysWOW64\jqisoxllvyd.exe"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Windows\SysWOW64\ggaskvtvpit.exe
        
        C:\Windows\system32\ggaskvtvpit.exe 1796 "C:\Windows\SysWOW64\wzovrwlwpkp.exe"
        94⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\occgtgwlkxn.exe
        
        C:\Windows\system32\occgtgwlkxn.exe 1448 "C:\Windows\SysWOW64\ggaskvtvpit.exe"
        95⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\okllfgtdevm.exe
        
        C:\Windows\system32\okllfgtdevm.exe 1484 "C:\Windows\SysWOW64\occgtgwlkxn.exe"
        96⤵
        Drops file in System32 directory
        
        PID:836
        
        C:\Windows\SysWOW64\jfqbfzbasfu.exe
        
        C:\Windows\system32\jfqbfzbasfu.exe 1812 "C:\Windows\SysWOW64\okllfgtdevm.exe"
        97⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\juggwqnotdu.exe
        
        C:\Windows\system32\juggwqnotdu.exe 1564 "C:\Windows\SysWOW64\jfqbfzbasfu.exe"
        98⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\mxjwjdpqblc.exe
        
        C:\Windows\system32\mxjwjdpqblc.exe 1808 "C:\Windows\SysWOW64\juggwqnotdu.exe"
        99⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\ohjubzxoikm.exe
        
        C:\Windows\system32\ohjubzxoikm.exe 1820 "C:\Windows\SysWOW64\mxjwjdpqblc.exe"
        100⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\okvmpdbipwe.exe
        
        C:\Windows\system32\okvmpdbipwe.exe 1540 "C:\Windows\SysWOW64\ohjubzxoikm.exe"
        101⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\eaiziucwlcz.exe
        
        C:\Windows\system32\eaiziucwlcz.exe 1836 "C:\Windows\SysWOW64\okvmpdbipwe.exe"
        102⤵
        
        PID:8
        
        C:\Windows\SysWOW64\ohmxatcwlbd.exe
        
        C:\Windows\system32\ohmxatcwlbd.exe 1828 "C:\Windows\SysWOW64\eaiziucwlcz.exe"
        103⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\ljcsiyiclow.exe
        
        C:\Windows\system32\ljcsiyiclow.exe 1676 "C:\Windows\SysWOW64\ohmxatcwlbd.exe"
        104⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\bncnmeewacr.exe
        
        C:\Windows\system32\bncnmeewacr.exe 1832 "C:\Windows\SysWOW64\ljcsiyiclow.exe"
        105⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\youaqpqxozb.exe
        
        C:\Windows\system32\youaqpqxozb.exe 1608 "C:\Windows\SysWOW64\bncnmeewacr.exe"
        106⤵
        Checks BIOS information in registry
        
        PID:3564
        
        C:\Windows\SysWOW64\gaxarnpwpjc.exe
        
        C:\Windows\system32\gaxarnpwpjc.exe 1852 "C:\Windows\SysWOW64\youaqpqxozb.exe"
        107⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Windows\SysWOW64\oehnjgrmcgw.exe
        
        C:\Windows\system32\oehnjgrmcgw.exe 1856 "C:\Windows\SysWOW64\gaxarnpwpjc.exe"
        108⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\qoydbczkjfg.exe
        
        C:\Windows\system32\qoydbczkjfg.exe 1552 "C:\Windows\SysWOW64\oehnjgrmcgw.exe"
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\tunnqujgdap.exe
        
        C:\Windows\system32\tunnqujgdap.exe 1860 "C:\Windows\SysWOW64\qoydbczkjfg.exe"
        110⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\qlxvesiqfkf.exe
        
        C:\Windows\system32\qlxvesiqfkf.exe 1592 "C:\Windows\SysWOW64\tunnqujgdap.exe"
        111⤵
        Checks BIOS information in registry
        
        PID:4876
        
        C:\Windows\SysWOW64\oxtjunodtiv.exe
        
        C:\Windows\system32\oxtjunodtiv.exe 1680 "C:\Windows\SysWOW64\qlxvesiqfkf.exe"
        112⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\gtttqwtvhvt.exe
        
        C:\Windows\system32\gtttqwtvhvt.exe 1632 "C:\Windows\SysWOW64\oxtjunodtiv.exe"
        113⤵
        Drops file in System32 directory
        
        PID:988
        
        C:\Windows\SysWOW64\gaqzheekjtt.exe
        
        C:\Windows\system32\gaqzheekjtt.exe 1644 "C:\Windows\SysWOW64\gtttqwtvhvt.exe"
        114⤵
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\tkxjkewucnf.exe
        
        C:\Windows\system32\tkxjkewucnf.exe 1848 "C:\Windows\SysWOW64\gaqzheekjtt.exe"
        115⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\wcozcaesjno.exe
        
        C:\Windows\system32\wcozcaesjno.exe 1892 "C:\Windows\SysWOW64\tkxjkewucnf.exe"
        116⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\ahihwkrbdoa.exe
        
        C:\Windows\system32\ahihwkrbdoa.exe 1496 "C:\Windows\SysWOW64\wcozcaesjno.exe"
        117⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\qticapovkjv.exe
        
        C:\Windows\system32\qticapovkjv.exe 1692 "C:\Windows\SysWOW64\ahihwkrbdoa.exe"
        118⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\bhjmhjosyuz.exe
        
        C:\Windows\system32\bhjmhjosyuz.exe 1888 "C:\Windows\SysWOW64\qticapovkjv.exe"
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\gqrhypuygis.exe
        
        C:\Windows\system32\gqrhypuygis.exe 1696 "C:\Windows\SysWOW64\bhjmhjosyuz.exe"
        120⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\wuzccursnvf.exe
        
        C:\Windows\system32\wuzccursnvf.exe 1504 "C:\Windows\SysWOW64\gqrhypuygis.exe"
        121⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\gtdamtzsntj.exe
        
        C:\Windows\system32\gtdamtzsntj.exe 1916 "C:\Windows\SysWOW64\wuzccursnvf.exe"
        122⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\qapferysnrv.exe
        
        C:\Windows\system32\qapferysnrv.exe 1896 "C:\Windows\SysWOW64\gtdamtzsntj.exe"
        123⤵
        Checks BIOS information in registry
        
        PID:2884
        
        C:\Windows\SysWOW64\ytoxlgcfvbp.exe
        
        C:\Windows\system32\ytoxlgcfvbp.exe 1952 "C:\Windows\SysWOW64\qapferysnrv.exe"
        124⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\gunxangawlj.exe
        
        C:\Windows\system32\gunxangawlj.exe 1912 "C:\Windows\SysWOW64\ytoxlgcfvbp.exe"
        125⤵
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\iauipfhwqys.exe
        
        C:\Windows\system32\iauipfhwqys.exe 1920 "C:\Windows\SysWOW64\gunxangawlj.exe"
        126⤵
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\dvzyhypbeha.exe
        
        C:\Windows\system32\dvzyhypbeha.exe 1928 "C:\Windows\SysWOW64\iauipfhwqys.exe"
        127⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\toeqcuxkmtv.exe
        
        C:\Windows\system32\toeqcuxkmtv.exe 1936 "C:\Windows\SysWOW64\dvzyhypbeha.exe"
        128⤵
        Drops file in System32 directory
        
        PID:4288
        
        C:\Windows\SysWOW64\ymbgqvwnhbg.exe
        
        C:\Windows\system32\ymbgqvwnhbg.exe 1464 "C:\Windows\SysWOW64\toeqcuxkmtv.exe"
        129⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\wdmgdlexbmw.exe
        
        C:\Windows\system32\wdmgdlexbmw.exe 1688 "C:\Windows\SysWOW64\ymbgqvwnhbg.exe"
        130⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\yqpjyllyvyg.exe
        
        C:\Windows\system32\yqpjyllyvyg.exe 1716 "C:\Windows\SysWOW64\wdmgdlexbmw.exe"
        131⤵
        
        PID:544
        
        C:\Windows\SysWOW64\grojnapmdia.exe
        
        C:\Windows\system32\grojnapmdia.exe 1728 "C:\Windows\SysWOW64\yqpjyllyvyg.exe"
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Windows\SysWOW64\qckpgxukeqe.exe
        
        C:\Windows\system32\qckpgxukeqe.exe 1724 "C:\Windows\SysWOW64\grojnapmdia.exe"
        133⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\tiqrwpwgzdo.exe
        
        C:\Windows\system32\tiqrwpwgzdo.exe 1760 "C:\Windows\SysWOW64\qckpgxukeqe.exe"
        134⤵
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\vofclgxktpp.exe
        
        C:\Windows\system32\vofclgxktpp.exe 1740 "C:\Windows\SysWOW64\tiqrwpwgzdo.exe"
        135⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\yvlnbyggnky.exe
        
        C:\Windows\system32\yvlnbyggnky.exe 1968 "C:\Windows\SysWOW64\vofclgxktpp.exe"
        136⤵
        Drops file in System32 directory
        
        PID:1264
        
        C:\Windows\SysWOW64\afdctuoeuki.exe
        
        C:\Windows\system32\afdctuoeuki.exe 1744 "C:\Windows\SysWOW64\yvlnbyggnky.exe"
        137⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\fotxbzmscfs.exe
        
        C:\Windows\system32\fotxbzmscfs.exe 1980 "C:\Windows\SysWOW64\afdctuoeuki.exe"
        138⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\afnayovmduz.exe
        
        C:\Windows\system32\afnayovmduz.exe 1588 "C:\Windows\SysWOW64\fotxbzmscfs.exe"
        139⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\gdrimpuyycs.exe
        
        C:\Windows\system32\gdrimpuyycs.exe 1776 "C:\Windows\SysWOW64\afnayovmduz.exe"
        140⤵
        
        PID:456
        
        C:\Windows\SysWOW64\osfdqaarmzl.exe
        
        C:\Windows\system32\osfdqaarmzl.exe 1712 "C:\Windows\SysWOW64\gdrimpuyycs.exe"
        141⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\qcxtiwzptzv.exe
        
        C:\Windows\system32\qcxtiwzptzv.exe 1992 "C:\Windows\SysWOW64\osfdqaarmzl.exe"
        142⤵
        Drops file in System32 directory
        
        PID:3044
        
        C:\Windows\SysWOW64\deeofijqbwh.exe
        
        C:\Windows\system32\deeofijqbwh.exe 1720 "C:\Windows\SysWOW64\qcxtiwzptzv.exe"
        143⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\qswwnzsmvhm.exe
        
        C:\Windows\system32\qswwnzsmvhm.exe 1768 "C:\Windows\SysWOW64\deeofijqbwh.exe"
        144⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3356
        
        C:\Windows\SysWOW64\vmqrqnsvede.exe
        
        C:\Windows\system32\vmqrqnsvede.exe 1772 "C:\Windows\SysWOW64\qswwnzsmvhm.exe"
        145⤵
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\vezjsicmkof.exe
        
        C:\Windows\system32\vezjsicmkof.exe 2012 "C:\Windows\SysWOW64\vmqrqnsvede.exe"
        146⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\vidcgmhgzae.exe
        
        C:\Windows\system32\vidcgmhgzae.exe 1580 "C:\Windows\SysWOW64\vezjsicmkof.exe"
        147⤵
        Checks BIOS information in registry
        
        PID:4156
        
        C:\Windows\SysWOW64\niozfaktzic.exe
        
        C:\Windows\system32\niozfaktzic.exe 2020 "C:\Windows\SysWOW64\vidcgmhgzae.exe"
        148⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:3520
        
        C:\Windows\SysWOW64\oeeaovjqhtb.exe
        
        C:\Windows\system32\oeeaovjqhtb.exe 1824 "C:\Windows\SysWOW64\niozfaktzic.exe"
        149⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\ydqxyuqpprf.exe
        
        C:\Windows\system32\ydqxyuqpprf.exe 1656 "C:\Windows\SysWOW64\oeeaovjqhtb.exe"
        150⤵
        Drops file in System32 directory
        
        PID:3648
        
        C:\Windows\SysWOW64\dbnfmvpbdax.exe
        
        C:\Windows\system32\dbnfmvpbdax.exe 2016 "C:\Windows\SysWOW64\ydqxyuqpprf.exe"
        151⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\iohnfxcbxbi.exe
        
        C:\Windows\system32\iohnfxcbxbi.exe 2028 "C:\Windows\SysWOW64\dbnfmvpbdax.exe"
        152⤵
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\luvyuwdfrvs.exe
        
        C:\Windows\system32\luvyuwdfrvs.exe 1844 "C:\Windows\SysWOW64\iohnfxcbxbi.exe"
        153⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\nxyvzkghzva.exe
        
        C:\Windows\system32\nxyvzkghzva.exe 1804 "C:\Windows\SysWOW64\luvyuwdfrvs.exe"
        154⤵
        Drops file in System32 directory
        
        PID:3092
        
        C:\Windows\SysWOW64\dqvijxiyfip.exe
        
        C:\Windows\system32\dqvijxiyfip.exe 1788 "C:\Windows\SysWOW64\nxyvzkghzva.exe"
        155⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\ljuixemlnsr.exe
        
        C:\Windows\system32\ljuixemlnsr.exe 1800 "C:\Windows\SysWOW64\dqvijxiyfip.exe"
        156⤵
        Checks BIOS information in registry
        
        PID:396
        
        C:\Windows\SysWOW64\nblyqaujuss.exe
        
        C:\Windows\system32\nblyqaujuss.exe 1872 "C:\Windows\SysWOW64\ljuixemlnsr.exe"
        157⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\isdjzrpqpmb.exe
        
        C:\Windows\system32\isdjzrpqpmb.exe 1904 "C:\Windows\SysWOW64\nblyqaujuss.exe"
        158⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\ihborabfjlb.exe
        
        C:\Windows\system32\ihborabfjlb.exe 1868 "C:\Windows\SysWOW64\isdjzrpqpmb.exe"
        159⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:400
        
        C:\Windows\SysWOW64\iacglmkwxwb.exe
        
        C:\Windows\system32\iacglmkwxwb.exe 2064 "C:\Windows\SysWOW64\ihborabfjlb.exe"
        160⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\qmmhusbmygu.exe
        
        C:\Windows\system32\qmmhusbmygu.exe 1884 "C:\Windows\SysWOW64\iacglmkwxwb.exe"
        161⤵
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\crdjibmyyti.exe
        
        C:\Windows\system32\crdjibmyyti.exe 2120 "C:\Windows\SysWOW64\qmmhusbmygu.exe"
        162⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\fuyhupoagsr.exe
        
        C:\Windows\system32\fuyhupoagsr.exe 1880 "C:\Windows\SysWOW64\crdjibmyyti.exe"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Windows\SysWOW64\nqjmeirqtpl.exe
        
        C:\Windows\system32\nqjmeirqtpl.exe 2032 "C:\Windows\SysWOW64\fuyhupoagsr.exe"
        164⤵
        
        PID:668
        
        C:\Windows\SysWOW64\qtmkqvtrbpu.exe
        
        C:\Windows\system32\qtmkqvtrbpu.exe 2076 "C:\Windows\SysWOW64\nqjmeirqtpl.exe"
        165⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\vgfskfgrvxf.exe
        
        C:\Windows\system32\vgfskfgrvxf.exe 1876 "C:\Windows\SysWOW64\qtmkqvtrbpu.exe"
        166⤵
        
        PID:888
        
        C:\Windows\SysWOW64\iplunwycpjr.exe
        
        C:\Windows\system32\iplunwycpjr.exe 2084 "C:\Windows\SysWOW64\vgfskfgrvxf.exe"
        167⤵
        Checks BIOS information in registry
        
        PID:640
        
        C:\Windows\SysWOW64\yxxctocyqkn.exe
        
        C:\Windows\system32\yxxctocyqkn.exe 2092 "C:\Windows\SysWOW64\iplunwycpjr.exe"
        168⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\vrtpkjidfhe.exe
        
        C:\Windows\system32\vrtpkjidfhe.exe 1924 "C:\Windows\SysWOW64\yxxctocyqkn.exe"
        169⤵
        Drops file in System32 directory
        
        PID:1504
        
        C:\Windows\SysWOW64\fqfvchpdffi.exe
        
        C:\Windows\system32\fqfvchpdffi.exe 1948 "C:\Windows\SysWOW64\vrtpkjidfhe.exe"
        170⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\ngsigsnwtcj.exe
        
        C:\Windows\system32\ngsigsnwtcj.exe 1640 "C:\Windows\SysWOW64\fqfvchpdffi.exe"
        171⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\ybttnmntgnn.exe
        
        C:\Windows\system32\ybttnmntgnn.exe 1840 "C:\Windows\SysWOW64\ngsigsnwtcj.exe"
        172⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\ffvgfxqrtch.exe
        
        C:\Windows\system32\ffvgfxqrtch.exe 1944 "C:\Windows\SysWOW64\ybttnmntgnn.exe"
        173⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\vvpompufvkd.exe
        
        C:\Windows\system32\vvpompufvkd.exe 2116 "C:\Windows\SysWOW64\ffvgfxqrtch.exe"
        174⤵
        Drops file in System32 directory
        
        PID:3404
        
        C:\Windows\SysWOW64\uoqygcewbww.exe
        
        C:\Windows\system32\uoqygcewbww.exe 2112 "C:\Windows\SysWOW64\vvpompufvkd.exe"
        175⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\fgfdksgzcuh.exe
        
        C:\Windows\system32\fgfdksgzcuh.exe 1960 "C:\Windows\SysWOW64\uoqygcewbww.exe"
        176⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\nzeezyjmcwb.exe
        
        C:\Windows\system32\nzeezyjmcwb.exe 1956 "C:\Windows\SysWOW64\fgfdksgzcuh.exe"
        177⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\csbrjumdqrx.exe
        
        C:\Windows\system32\csbrjumdqrx.exe 2140 "C:\Windows\SysWOW64\nzeezyjmcwb.exe"
        178⤵
        
        PID:924
        
        C:\Windows\SysWOW64\denjxyqxxdx.exe
        
        C:\Windows\system32\denjxyqxxdx.exe 1908 "C:\Windows\SysWOW64\csbrjumdqrx.exe"
        179⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\nzobftrvloa.exe
        
        C:\Windows\system32\nzobftrvloa.exe 2144 "C:\Windows\SysWOW64\denjxyqxxdx.exe"
        180⤵
        Modifies registry class
        
        PID:2440
        
        C:\Windows\SysWOW64\yjezjjtymmd.exe
        
        C:\Windows\system32\yjezjjtymmd.exe 1988 "C:\Windows\SysWOW64\nzobftrvloa.exe"
        181⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\xytejzwmokd.exe
        
        C:\Windows\system32\xytejzwmokd.exe 2160 "C:\Windows\SysWOW64\yjezjjtymmd.exe"
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Windows\SysWOW64\iqjknpyppig.exe
        
        C:\Windows\system32\iqjknpyppig.exe 2156 "C:\Windows\SysWOW64\xytejzwmokd.exe"
        183⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\spvhyofppgk.exe
        
        C:\Windows\system32\spvhyofppgk.exe 2172 "C:\Windows\SysWOW64\iqjknpyppig.exe"
        184⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\xzdcouluoud.exe
        
        C:\Windows\system32\xzdcouluoud.exe 1976 "C:\Windows\SysWOW64\spvhyofppgk.exe"
        185⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\augabhgwwce.exe
        
        C:\Windows\system32\augabhgwwce.exe 1864 "C:\Windows\SysWOW64\xzdcouluoud.exe"
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Windows\SysWOW64\ajwfsprkyae.exe
        
        C:\Windows\system32\ajwfsprkyae.exe 1972 "C:\Windows\SysWOW64\augabhgwwce.exe"
        187⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\ctwvklzjfan.exe
        
        C:\Windows\system32\ctwvklzjfan.exe 2184 "C:\Windows\SysWOW64\ajwfsprkyae.exe"
        188⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\iytlymyuajy.exe
        
        C:\Windows\system32\iytlymyuajy.exe 2004 "C:\Windows\SysWOW64\ctwvklzjfan.exe"
        189⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\nabgokeazwr.exe
        
        C:\Windows\system32\nabgokeazwr.exe 2180 "C:\Windows\SysWOW64\iytlymyuajy.exe"
        190⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2220
        
        C:\Windows\SysWOW64\fpylgahwbvr.exe
        
        C:\Windows\system32\fpylgahwbvr.exe 1816 "C:\Windows\SysWOW64\nabgokeazwr.exe"
        191⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\najlgyfncfj.exe
        
        C:\Windows\system32\najlgyfncfj.exe 2200 "C:\Windows\SysWOW64\fpylgahwbvr.exe"
        192⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\qhpwwqgjxrt.exe
        
        C:\Windows\system32\qhpwwqgjxrt.exe 2188 "C:\Windows\SysWOW64\najlgyfncfj.exe"
        193⤵
        
        PID:468
        
        C:\Windows\SysWOW64\vixrmvmxend.exe
        
        C:\Windows\system32\vixrmvmxend.exe 2036 "C:\Windows\SysWOW64\qhpwwqgjxrt.exe"
        194⤵
        
        PID:856
        
        C:\Windows\SysWOW64\xdathwbpyao.exe
        
        C:\Windows\system32\xdathwbpyao.exe 2196 "C:\Windows\SysWOW64\vixrmvmxend.exe"
        195⤵
        Checks BIOS information in registry
        
        PID:4596
        
        C:\Windows\SysWOW64\ftwglgyilxh.exe
        
        C:\Windows\system32\ftwglgyilxh.exe 1932 "C:\Windows\SysWOW64\xdathwbpyao.exe"
        196⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\kfpoeidqgfa.exe
        
        C:\Windows\system32\kfpoeidqgfa.exe 1984 "C:\Windows\SysWOW64\ftwglgyilxh.exe"
        197⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\svdcqsijtuu.exe
        
        C:\Windows\system32\svdcqsijtuu.exe 2216 "C:\Windows\SysWOW64\kfpoeidqgfa.exe"
        198⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\uevrioqiacd.exe
        
        C:\Windows\system32\uevrioqiacd.exe 2040 "C:\Windows\SysWOW64\svdcqsijtuu.exe"
        199⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\hrmpokpvpbq.exe
        
        C:\Windows\system32\hrmpokpvpbq.exe 2228 "C:\Windows\SysWOW64\uevrioqiacd.exe"
        200⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\nxjxclogkca.exe
        
        C:\Windows\system32\nxjxclogkca.exe 2220 "C:\Windows\SysWOW64\hrmpokpvpbq.exe"
        201⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\uttklwrwwzu.exe
        
        C:\Windows\system32\uttklwrwwzu.exe 2232 "C:\Windows\SysWOW64\nxjxclogkca.exe"
        202⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\kgcfpknidmq.exe
        
        C:\Windows\system32\kgcfpknidmq.exe 2044 "C:\Windows\SysWOW64\uttklwrwwzu.exe"
        203⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\nqtvhgvokua.exe
        
        C:\Windows\system32\nqtvhgvokua.exe 1940 "C:\Windows\SysWOW64\kgcfpknidmq.exe"
        204⤵
        
        PID:436
        
        C:\Windows\SysWOW64\agoxqobwlgn.exe
        
        C:\Windows\system32\agoxqobwlgn.exe 2000 "C:\Windows\SysWOW64\nqtvhgvokua.exe"
        205⤵
        
        PID:728
        
        C:\Windows\SysWOW64\kcpiyictzrq.exe
        
        C:\Windows\system32\kcpiyictzrq.exe 2252 "C:\Windows\SysWOW64\agoxqobwlgn.exe"
        206⤵
        Checks BIOS information in registry
        
        PID:812
        
        C:\Windows\SysWOW64\efuyyckqmsy.exe
        
        C:\Windows\system32\efuyyckqmsy.exe 2256 "C:\Windows\SysWOW64\kcpiyictzrq.exe"
        207⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\nqeyzaioocz.exe
        
        C:\Windows\system32\nqeyzaioocz.exe 2068 "C:\Windows\SysWOW64\efuyyckqmsy.exe"
        208⤵
        
        PID:880
        
        C:\Windows\SysWOW64\xpivryqowad.exe
        
        C:\Windows\system32\xpivryqowad.exe 2072 "C:\Windows\SysWOW64\nqeyzaioocz.exe"
        209⤵
        Modifies registry class
        
        PID:2224
        
        C:\Windows\SysWOW64\cnnlxzpsjjn.exe
        
        C:\Windows\system32\cnnlxzpsjjn.exe 2268 "C:\Windows\SysWOW64\xpivryqowad.exe"
        210⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\fuuomryvdvw.exe
        
        C:\Windows\system32\fuuomryvdvw.exe 2272 "C:\Windows\SysWOW64\cnnlxzpsjjn.exe"
        211⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\hpwqhsfoxig.exe
        
        C:\Windows\system32\hpwqhsfoxig.exe 2024 "C:\Windows\SysWOW64\fuuomryvdvw.exe"
        212⤵
        Checks BIOS information in registry
        
        PID:4404
        
        C:\Windows\SysWOW64\pivrwyjjfsa.exe
        
        C:\Windows\system32\pivrwyjjfsa.exe 1900 "C:\Windows\SysWOW64\hpwqhsfoxig.exe"
        213⤵
        Drops file in System32 directory
        
        PID:2676
        
        C:\Windows\SysWOW64\zdwjdtkhtde.exe
        
        C:\Windows\system32\zdwjdtkhtde.exe 2100 "C:\Windows\SysWOW64\pivrwyjjfsa.exe"
        214⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\mqozjxiuzcq.exe
        
        C:\Windows\system32\mqozjxiuzcq.exe 2080 "C:\Windows\SysWOW64\zdwjdtkhtde.exe"
        215⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\swlhxypfuli.exe
        
        C:\Windows\system32\swlhxypfuli.exe 1996 "C:\Windows\SysWOW64\mqozjxiuzcq.exe"
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
        
        C:\Windows\SysWOW64\fngjfgnmvxn.exe
        
        C:\Windows\system32\fngjfgnmvxn.exe 2132 "C:\Windows\SysWOW64\swlhxypfuli.exe"
        217⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\kowewdtsclg.exe
        
        C:\Windows\system32\kowewdtsclg.exe 2304 "C:\Windows\SysWOW64\fngjfgnmvxn.exe"
        218⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\mucplvcwxgp.exe
        
        C:\Windows\system32\mucplvcwxgp.exe 1964 "C:\Windows\SysWOW64\kowewdtsclg.exe"
        219⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\mjauclfkqeh.exe
        
        C:\Windows\system32\mjauclfkqeh.exe 2300 "C:\Windows\SysWOW64\mucplvcwxgp.exe"
        220⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\xfbfkggiept.exe
        
        C:\Windows\system32\xfbfkggiept.exe 1296 "C:\Windows\SysWOW64\mjauclfkqeh.exe"
        221⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\cojaadmnmde.exe
        
        C:\Windows\system32\cojaadmnmde.exe 2056 "C:\Windows\SysWOW64\xfbfkggiept.exe"
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
        
        C:\Windows\SysWOW64\cdwvmojgzax.exe
        
        C:\Windows\system32\cdwvmojgzax.exe 2124 "C:\Windows\SysWOW64\cojaadmnmde.exe"
        223⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\mzxfuismnli.exe
        
        C:\Windows\system32\mzxfuismnli.exe 2324 "C:\Windows\SysWOW64\cdwvmojgzax.exe"
        224⤵
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\ragaknqsuzt.exe
        
        C:\Windows\system32\ragaknqsuzt.exe 2096 "C:\Windows\SysWOW64\mzxfuismnli.exe"
        225⤵
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\cwgtsiypikx.exe
        
        C:\Windows\system32\cwgtsiypikx.exe 2060 "C:\Windows\SysWOW64\ragaknqsuzt.exe"
        226⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\mdlqchypiib.exe
        
        C:\Windows\system32\mdlqchypiib.exe 2328 "C:\Windows\SysWOW64\cwgtsiypikx.exe"
        227⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\upvqlfwnjsc.exe
        
        C:\Windows\system32\upvqlfwnjsc.exe 2104 "C:\Windows\SysWOW64\mdlqchypiib.exe"
        228⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\zfslhtiqqon.exe
        
        C:\Windows\system32\zfslhtiqqon.exe 2152 "C:\Windows\SysWOW64\upvqlfwnjsc.exe"
        229⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\rqfdhqioxpt.exe
        
        C:\Windows\system32\rqfdhqioxpt.exe 2168 "C:\Windows\SysWOW64\zfslhtiqqon.exe"
        230⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\uhxorzmvscb.exe
        
        C:\Windows\system32\uhxorzmvscb.exe 2128 "C:\Windows\SysWOW64\rqfdhqioxpt.exe"
        231⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\zuqwkjrwmkn.exe
        
        C:\Windows\system32\zuqwkjrwmkn.exe 2352 "C:\Windows\SysWOW64\uhxorzmvscb.exe"
        232⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\hnpwrqurnug.exe
        
        C:\Windows\system32\hnpwrqurnug.exe 2356 "C:\Windows\SysWOW64\zuqwkjrwmkn.exe"
        233⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\sffudgouokj.exe
        
        C:\Windows\system32\sffudgouokj.exe 2212 "C:\Windows\SysWOW64\hnpwrqurnug.exe"
        234⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\wrybpqbcitd.exe
        
        C:\Windows\system32\wrybpqbcitd.exe 2164 "C:\Windows\SysWOW64\sffudgouokj.exe"
        235⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\fhupasyvwqw.exe
        
        C:\Windows\system32\fhupasyvwqw.exe 2224 "C:\Windows\SysWOW64\wrybpqbcitd.exe"
        236⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\jtowucdvqrp.exe
        
        C:\Windows\system32\jtowucdvqrp.exe 2052 "C:\Windows\SysWOW64\fhupasyvwqw.exe"
        237⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\rmnxajhrqbj.exe
        
        C:\Windows\system32\rmnxajhrqbj.exe 2108 "C:\Windows\SysWOW64\jtowucdvqrp.exe"
        238⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\btruthpqqzn.exe
        
        C:\Windows\system32\btruthpqqzn.exe 2088 "C:\Windows\SysWOW64\rmnxajhrqbj.exe"
        239⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\kiepwsmjmwg.exe
        
        C:\Windows\system32\kiepwsmjmwg.exe 2320 "C:\Windows\SysWOW64\btruthpqqzn.exe"
        240⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\ovypqtysywa.exe
        
        C:\Windows\system32\ovypqtysywa.exe 2396 "C:\Windows\SysWOW64\kiepwsmjmwg.exe"
        241⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\xhixrapihgt.exe
        
        C:\Windows\system32\xhixrapihgt.exe 2236 "C:\Windows\SysWOW64\ovypqtysywa.exe"
        242⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\znxagrymctc.exe
        
        C:\Windows\system32\znxagrymctc.exe 2348 "C:\Windows\SysWOW64\xhixrapihgt.exe"
        243⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\hkznxcbcpqw.exe
        
        C:\Windows\system32\hkznxcbcpqw.exe 2240 "C:\Windows\SysWOW64\znxagrymctc.exe"
        244⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\pkynerfppay.exe
        
        C:\Windows\system32\pkynerfppay.exe 2404 "C:\Windows\SysWOW64\hkznxcbcpqw.exe"
        245⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\wstgyhohwct.exe
        
        C:\Windows\system32\wstgyhohwct.exe 2260 "C:\Windows\SysWOW64\pkynerfppay.exe"
        246⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\mwtacmlcdxp.exe
        
        C:\Windows\system32\mwtacmlcdxp.exe 2416 "C:\Windows\SysWOW64\wstgyhohwct.exe"
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\scyqinkfyyz.exe
        
        C:\Windows\system32\scyqinkfyyz.exe 2420 "C:\Windows\SysWOW64\mwtacmlcdxp.exe"
        248⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\zyjwzgvdlvb.exe
        
        C:\Windows\system32\zyjwzgvdlvb.exe 2384 "C:\Windows\SysWOW64\scyqinkfyyz.exe"
        249⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\fefmnzuggdl.exe
        
        C:\Windows\system32\fefmnzuggdl.exe 2428 "C:\Windows\SysWOW64\zyjwzgvdlvb.exe"
        250⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\pagwuuvmugp.exe
        
        C:\Windows\system32\pagwuuvmugp.exe 2176 "C:\Windows\SysWOW64\fefmnzuggdl.exe"
        251⤵
        Checks BIOS information in registry
        
        PID:3100
        
        C:\Windows\SysWOW64\cqbzdcatvbc.exe
        
        C:\Windows\system32\cqbzdcatvbc.exe 2264 "C:\Windows\SysWOW64\pagwuuvmugp.exe"
        252⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\pshooofuaap.exe
        
        C:\Windows\system32\pshooofuaap.exe 2408 "C:\Windows\SysWOW64\cqbzdcatvbc.exe"
        253⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:4320
        
        C:\Windows\SysWOW64\zoizejfaolt.exe
        
        C:\Windows\system32\zoizejfaolt.exe 2444 "C:\Windows\SysWOW64\pshooofuaap.exe"
        254⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\zrursnkudwt.exe
        
        C:\Windows\system32\zrursnkudwt.exe 2288 "C:\Windows\SysWOW64\zoizejfaolt.exe"
        255⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:852
        
        C:\Windows\SysWOW64\zgsxkvviwvt.exe
        
        C:\Windows\system32\zgsxkvviwvt.exe 2452 "C:\Windows\SysWOW64\zrursnkudwt.exe"
        256⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:448
        
        C:\Windows\SysWOW64\ujnuwqxkeub.exe
        
        C:\Windows\system32\ujnuwqxkeub.exe 2276 "C:\Windows\SysWOW64\zgsxkvviwvt.exe"
        257⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\uylanzayytt.exe
        
        C:\Windows\system32\uylanzayytt.exe 2296 "C:\Windows\SysWOW64\ujnuwqxkeub.exe"
        258⤵
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\zseuyvbhgpl.exe
        
        C:\Windows\system32\zseuyvbhgpl.exe 2372 "C:\Windows\SysWOW64\uylanzayytt.exe"
        259⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\exycrxfpapw.exe
        
        C:\Windows\system32\exycrxfpapw.exe 2468 "C:\Windows\SysWOW64\zseuyvbhgpl.exe"
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Windows\SysWOW64\mumyviciomy.exe
        
        C:\Windows\system32\mumyviciomy.exe 2148 "C:\Windows\SysWOW64\exycrxfpapw.exe"
        261⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\rzfxojpqivj.exe
        
        C:\Windows\system32\rzfxojpqivj.exe 2476 "C:\Windows\SysWOW64\mumyviciomy.exe"
        262⤵
        Checks BIOS information in registry
        
        PID:3144
        
        C:\Windows\SysWOW64\byjdzixqjtn.exe
        
        C:\Windows\system32\byjdzixqjtn.exe 2424 "C:\Windows\SysWOW64\rzfxojpqivj.exe"
        263⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\htdykfpzrhf.exe
        
        C:\Windows\system32\htdykfpzrhf.exe 2316 "C:\Windows\SysWOW64\byjdzixqjtn.exe"
        264⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\ptcyqutnrrz.exe
        
        C:\Windows\system32\ptcyqutnrrz.exe 2488 "C:\Windows\SysWOW64\htdykfpzrhf.exe"
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Windows\SysWOW64\wubyfaxisbb.exe
        
        C:\Windows\system32\wubyfaxisbb.exe 2284 "C:\Windows\SysWOW64\ptcyqutnrrz.exe"
        266⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\hqcjmvyffme.exe
        
        C:\Windows\system32\hqcjmvyffme.exe 2492 "C:\Windows\SysWOW64\wubyfaxisbb.exe"
        267⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\oxxjhkhxnoz.exe
        
        C:\Windows\system32\oxxjhkhxnoz.exe 2192 "C:\Windows\SysWOW64\hqcjmvyffme.exe"
        268⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\ejuwqgkotjw.exe
        
        C:\Windows\system32\ejuwqgkotjw.exe 2500 "C:\Windows\SysWOW64\oxxjhkhxnoz.exe"
        269⤵
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\euyofkoiivv.exe
        
        C:\Windows\system32\euyofkoiivv.exe 2280 "C:\Windows\SysWOW64\ejuwqgkotjw.exe"
        270⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\rhqmlonnoui.exe
        
        C:\Windows\system32\rhqmlonnoui.exe 2512 "C:\Windows\SysWOW64\euyofkoiivv.exe"
        271⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\euhcqslactu.exe
        
        C:\Windows\system32\euhcqslactu.exe 2312 "C:\Windows\SysWOW64\rhqmlonnoui.exe"
        272⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\oqamymuxqey.exe
        
        C:\Windows\system32\oqamymuxqey.exe 2332 "C:\Windows\SysWOW64\euhcqslactu.exe"
        273⤵
        Drops file in System32 directory
        
        PID:4524
        
        C:\Windows\SysWOW64\zxmjqlcxqcc.exe
        
        C:\Windows\system32\zxmjqlcxqcc.exe 2244 "C:\Windows\SysWOW64\oqamymuxqey.exe"
        274⤵
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\mnhmzlzerop.exe
        
        C:\Windows\system32\mnhmzlzerop.exe 2360 "C:\Windows\SysWOW64\zxmjqlcxqcc.exe"
        275⤵
        Drops file in System32 directory
        
        PID:4500
        
        C:\Windows\SysWOW64\rlmcfmgqepz.exe
        
        C:\Windows\system32\rlmcfmgqepz.exe 2364 "C:\Windows\SysWOW64\mnhmzlzerop.exe"
        276⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:216
        
        C:\Windows\SysWOW64\uohsrabrmxi.exe
        
        C:\Windows\system32\uohsrabrmxi.exe 2336 "C:\Windows\SysWOW64\rlmcfmgqepz.exe"
        277⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\zpxvifhxtks.exe
        
        C:\Windows\system32\zpxvifhxtks.exe 2344 "C:\Windows\SysWOW64\uohsrabrmxi.exe"
        278⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Windows\SysWOW64\bhpkabpvasc.exe
        
        C:\Windows\system32\bhpkabpvasc.exe 2204 "C:\Windows\SysWOW64\zpxvifhxtks.exe"
        279⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\jwdxmemoohd.exe
        
        C:\Windows\system32\jwdxmemoohd.exe 2292 "C:\Windows\SysWOW64\bhpkabpvasc.exe"
        280⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\rbnlvxwejey.exe
        
        C:\Windows\system32\rbnlvxwejey.exe 2136 "C:\Windows\SysWOW64\jwdxmemoohd.exe"
        281⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\bwovdrxjwpb.exe
        
        C:\Windows\system32\bwovdrxjwpb.exe 2564 "C:\Windows\SysWOW64\rbnlvxwejey.exe"
        282⤵
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\rqmvynfsfbx.exe
        
        C:\Windows\system32\rqmvynfsfbx.exe 2560 "C:\Windows\SysWOW64\bwovdrxjwpb.exe"
        283⤵
        Checks BIOS information in registry
        
        PID:1144
        
        C:\Windows\SysWOW64\uwagnegozvy.exe
        
        C:\Windows\system32\uwagnegozvy.exe 2392 "C:\Windows\SysWOW64\rqmvynfsfbx.exe"
        284⤵
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\jelguokdtwu.exe
        
        C:\Windows\system32\jelguokdtwu.exe 2556 "C:\Windows\SysWOW64\uwagnegozvy.exe"
        285⤵
        Drops file in System32 directory
        
        PID:5116
        
        C:\Windows\SysWOW64\mksrjglhnie.exe
        
        C:\Windows\system32\mksrjglhnie.exe 2308 "C:\Windows\SysWOW64\jelguokdtwu.exe"
        286⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\prgtzxmcidf.exe
        
        C:\Windows\system32\prgtzxmcidf.exe 2400 "C:\Windows\SysWOW64\mksrjglhnie.exe"
        287⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\wytttnwvhfi.exe
        
        C:\Windows\system32\wytttnwvhfi.exe 2584 "C:\Windows\SysWOW64\prgtzxmcidf.exe"
        288⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\jtljzruhvmu.exe
        
        C:\Windows\system32\jtljzruhvmu.exe 2412 "C:\Windows\SysWOW64\wytttnwvhfi.exe"
        289⤵
        
        PID:768
        
        C:\Windows\SysWOW64\eazuoiedqzv.exe
        
        C:\Windows\system32\eazuoiedqzv.exe 2340 "C:\Windows\SysWOW64\jtljzruhvmu.exe"
        290⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\lwbzybgtlwy.exe
        
        C:\Windows\system32\lwbzybgtlwy.exe 2432 "C:\Windows\SysWOW64\eazuoiedqzv.exe"
        291⤵
        Checks BIOS information in registry
        
        PID:2288
        
        C:\Windows\SysWOW64\rqvciqhcljh.exe
        
        C:\Windows\system32\rqvciqhcljh.exe 2596 "C:\Windows\SysWOW64\lwbzybgtlwy.exe"
        292⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\whaxeesnsfb.exe
        
        C:\Windows\system32\whaxeesnsfb.exe 2604 "C:\Windows\SysWOW64\rqvciqhcljh.exe"
        293⤵
        
        PID:644
        
        C:\Windows\SysWOW64\yngzuwtjmsc.exe
        
        C:\Windows\system32\yngzuwtjmsc.exe 2456 "C:\Windows\SysWOW64\whaxeesnsfb.exe"
        294⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\odahbfxfgsz.exe
        
        C:\Windows\system32\odahbfxfgsz.exe 2600 "C:\Windows\SysWOW64\yngzuwtjmsc.exe"
        295⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\qjgsqxybani.exe
        
        C:\Windows\system32\qjgsqxybani.exe 2380 "C:\Windows\SysWOW64\odahbfxfgsz.exe"
        296⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\ycfkxmcxipc.exe
        
        C:\Windows\system32\ycfkxmcxipc.exe 2616 "C:\Windows\SysWOW64\qjgsqxybani.exe"
        297⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\dlnnnridiku.exe
        
        C:\Windows\system32\dlnnnridiku.exe 2480 "C:\Windows\SysWOW64\ycfkxmcxipc.exe"
        298⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\whmfhgdeqmr.exe
        
        C:\Windows\system32\whmfhgdeqmr.exe 2624 "C:\Windows\SysWOW64\dlnnnridiku.exe"
        299⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Windows\SysWOW64\bxjadmopwil.exe
        
        C:\Windows\system32\bxjadmopwil.exe 2368 "C:\Windows\SysWOW64\whmfhgdeqmr.exe"
        300⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\okaqjqnulhx.exe
        
        C:\Windows\system32\okaqjqnulhx.exe 2208 "C:\Windows\SysWOW64\bxjadmopwil.exe"
        301⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\vpkdabqkyes.exe
        
        C:\Windows\system32\vpkdabqkyes.exe 2464 "C:\Windows\SysWOW64\okaqjqnulhx.exe"
        302⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\emyqelvdtbl.exe
        
        C:\Windows\system32\emyqelvdtbl.exe 2636 "C:\Windows\SysWOW64\vpkdabqkyes.exe"
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Windows\SysWOW64\jnglvrtqtoe.exe
        
        C:\Windows\system32\jnglvrtqtoe.exe 2472 "C:\Windows\SysWOW64\emyqelvdtbl.exe"
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Windows\SysWOW64\jnqrgqyiwnd.exe
        
        C:\Windows\system32\jnqrgqyiwnd.exe 2448 "C:\Windows\SysWOW64\jnglvrtqtoe.exe"
        305⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\oabyzadqiwo.exe
        
        C:\Windows\system32\oabyzadqiwo.exe 2508 "C:\Windows\SysWOW64\jnqrgqyiwnd.exe"
        306⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\equggkhfjwk.exe
        
        C:\Windows\system32\equggkhfjwk.exe 2536 "C:\Windows\SysWOW64\oabyzadqiwo.exe"
        307⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\jrdbxpmljsv.exe
        
        C:\Windows\system32\jrdbxpmljsv.exe 2460 "C:\Windows\SysWOW64\equggkhfjwk.exe"
        308⤵
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\rsccdwqgrux.exe
        
        C:\Windows\system32\rsccdwqgrux.exe 2676 "C:\Windows\SysWOW64\jrdbxpmljsv.exe"
        309⤵
        
        PID:632
        
        C:\Windows\SysWOW64\wtkwubomrpi.exe
        
        C:\Windows\system32\wtkwubomrpi.exe 2516 "C:\Windows\SysWOW64\rsccdwqgrux.exe"
        310⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\eigkyetfnmj.exe
        
        C:\Windows\system32\eigkyetfnmj.exe 2572 "C:\Windows\SysWOW64\wtkwubomrpi.exe"
        311⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\rhamgmrmfyw.exe
        
        C:\Windows\system32\rhamgmrmfyw.exe 2440 "C:\Windows\SysWOW64\eigkyetfnmj.exe"
        312⤵
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\wmuuzweuazi.exe
        
        C:\Windows\system32\wmuuzweuazi.exe 2376 "C:\Windows\SysWOW64\rhamgmrmfyw.exe"
        313⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\dmtuocaqijb.exe
        
        C:\Windows\system32\dmtuocaqijb.exe 2692 "C:\Windows\SysWOW64\wmuuzweuazi.exe"
        314⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\trtpsqecpxx.exe
        
        C:\Windows\system32\trtpsqecpxx.exe 2684 "C:\Windows\SysWOW64\dmtuocaqijb.exe"
        315⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\tjcamcotviy.exe
        
        C:\Windows\system32\tjcamcotviy.exe 2436 "C:\Windows\SysWOW64\trtpsqecpxx.exe"
        316⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\bnmnvnrjqfs.exe
        
        C:\Windows\system32\bnmnvnrjqfs.exe 2388 "C:\Windows\SysWOW64\tjcamcotviy.exe"
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
        
        C:\Windows\SysWOW64\robvxwpakfn.exe
        
        C:\Windows\system32\robvxwpakfn.exe 2700 "C:\Windows\SysWOW64\bnmnvnrjqfs.exe"
        318⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\wbvdqyujeoy.exe
        
        C:\Windows\system32\wbvdqyujeoy.exe 2552 "C:\Windows\SysWOW64\robvxwpakfn.exe"
        319⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Windows\SysWOW64\gtkivowmfmj.exe
        
        C:\Windows\system32\gtkivowmfmj.exe 2524 "C:\Windows\SysWOW64\wbvdqyujeoy.exe"
        320⤵
        Checks BIOS information in registry
        
        PID:4240
        
        C:\Windows\SysWOW64\oxunmhzbsje.exe
        
        C:\Windows\system32\oxunmhzbsje.exe 2532 "C:\Windows\SysWOW64\gtkivowmfmj.exe"
        321⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\wufbvsbrfyy.exe
        
        C:\Windows\system32\wufbvsbrfyy.exe 2496 "C:\Windows\SysWOW64\oxunmhzbsje.exe"
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Windows\SysWOW64\jdllysbchkk.exe
        
        C:\Windows\system32\jdllysbchkk.exe 2548 "C:\Windows\SysWOW64\wufbvsbrfyy.exe"
        323⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\yevqcvnluic.exe
        
        C:\Windows\system32\yevqcvnluic.exe 2540 "C:\Windows\SysWOW64\jdllysbchkk.exe"
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Windows\SysWOW64\gtrmggkeied.exe
        
        C:\Windows\system32\gtrmggkeied.exe 2724 "C:\Windows\SysWOW64\yevqcvnluic.exe"
        325⤵
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\ldzgwlqkqao.exe
        
        C:\Windows\system32\ldzgwlqkqao.exe 2736 "C:\Windows\SysWOW64\gtrmggkeied.exe"
        326⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\yqiwchpweza.exe
        
        C:\Windows\system32\yqiwchpweza.exe 2576 "C:\Windows\SysWOW64\ldzgwlqkqao.exe"
        327⤵
        
        PID:540
        
        C:\Windows\SysWOW64\bwxzsyysymk.exe
        
        C:\Windows\system32\bwxzsyysymk.exe 2740 "C:\Windows\SysWOW64\yqiwchpweza.exe"
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:392
        
        C:\Windows\SysWOW64\iahmjsbilje.exe
        
        C:\Windows\system32\iahmjsbilje.exe 2528 "C:\Windows\SysWOW64\bwxzsyysymk.exe"
        329⤵
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\tsxroidlmhh.exe
        
        C:\Windows\system32\tsxroidlmhh.exe 2756 "C:\Windows\SysWOW64\iahmjsbilje.exe"
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Windows\SysWOW64\vgzujikmgur.exe
        
        C:\Windows\system32\vgzujikmgur.exe 2544 "C:\Windows\SysWOW64\tsxroidlmhh.exe"
        331⤵
        Checks BIOS information in registry
        
        PID:2868
        
        C:\Windows\SysWOW64\dvnhnlhfuqk.exe
        
        C:\Windows\system32\dvnhnlhfuqk.exe 2588 "C:\Windows\SysWOW64\vgzujikmgur.exe"
        332⤵
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\lzxueeruoff.exe
        
        C:\Windows\system32\lzxueeruoff.exe 2620 "C:\Windows\SysWOW64\dvnhnlhfuqk.exe"
        333⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\ymhkkzqzdnr.exe
        
        C:\Windows\system32\ymhkkzqzdnr.exe 2772 "C:\Windows\SysWOW64\lzxueeruoff.exe"
        334⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\gnokyouvdot.exe
        
        C:\Windows\system32\gnokyouvdot.exe 2592 "C:\Windows\SysWOW64\ymhkkzqzdnr.exe"
        335⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\nubclewnczo.exe
        
        C:\Windows\system32\nubclewnczo.exe 2520 "C:\Windows\SysWOW64\gnokyouvdot.exe"
        336⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\yqcvsyekqkr.exe
        
        C:\Windows\system32\yqcvsyekqkr.exe 2628 "C:\Windows\SysWOW64\nubclewnczo.exe"
        337⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\ngnvziazsko.exe
        
        C:\Windows\system32\ngnvziazsko.exe 2640 "C:\Windows\SysWOW64\yqcvsyekqkr.exe"
        338⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\vvbilsfsfhh.exe
        
        C:\Windows\system32\vvbilsfsfhh.exe 2780 "C:\Windows\SysWOW64\ngnvziazsko.exe"
        339⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\bwrltxlfnva.exe
        
        C:\Windows\system32\bwrltxlfnva.exe 2788 "C:\Windows\SysWOW64\vvbilsfsfhh.exe"
        340⤵
        Checks BIOS information in registry
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\lphigofaotd.exe
        
        C:\Windows\system32\lphigofaotd.exe 2632 "C:\Windows\SysWOW64\bwrltxlfnva.exe"
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Windows\SysWOW64\lexoxwqxizd.exe
        
        C:\Windows\system32\lexoxwqxizd.exe 2696 "C:\Windows\SysWOW64\lphigofaotd.exe"
        342⤵
        Drops file in System32 directory
        
        PID:760
        
        C:\Windows\SysWOW64\tihbhhtmuox.exe
        
        C:\Windows\system32\tihbhhtmuox.exe 2796 "C:\Windows\SysWOW64\lexoxwqxizd.exe"
        343⤵
        Checks BIOS information in registry
        
        PID:3284
        
        C:\Windows\SysWOW64\dawytfvhvma.exe
        
        C:\Windows\system32\dawytfvhvma.exe 2860 "C:\Windows\SysWOW64\tihbhhtmuox.exe"
        344⤵
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\ovxrbawnjxe.exe
        
        C:\Windows\system32\ovxrbawnjxe.exe 2644 "C:\Windows\SysWOW64\dawytfvhvma.exe"
        345⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\qfpgtwdlyxn.exe
        
        C:\Windows\system32\qfpgtwdlyxn.exe 2580 "C:\Windows\SysWOW64\ovxrbawnjxe.exe"
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\ykzulhgblui.exe
        
        C:\Windows\system32\ykzulhgblui.exe 2808 "C:\Windows\SysWOW64\qfpgtwdlyxn.exe"
        347⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\lxjjqlfoztu.exe
        
        C:\Windows\system32\lxjjqlfoztu.exe 2656 "C:\Windows\SysWOW64\ykzulhgblui.exe"
        348⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\vpypvbhiarx.exe
        
        C:\Windows\system32\vpypvbhiarx.exe 2608 "C:\Windows\SysWOW64\lxjjqlfoztu.exe"
        349⤵
        Drops file in System32 directory
        
        PID:332
        
        C:\Windows\SysWOW64\wslhkflchcx.exe
        
        C:\Windows\system32\wslhkflchcx.exe 2832 "C:\Windows\SysWOW64\vpypvbhiarx.exe"
        350⤵
        Checks BIOS information in registry
        
        PID:2304
        
        C:\Windows\SysWOW64\yonkffsdbxh.exe
        
        C:\Windows\system32\yonkffsdbxh.exe 2824 "C:\Windows\SysWOW64\wslhkflchcx.exe"
        351⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\ggmktuwqbzb.exe
        
        C:\Windows\system32\ggmktuwqbzb.exe 2652 "C:\Windows\SysWOW64\yonkffsdbxh.exe"
        352⤵
        Drops file in System32 directory
        
        PID:220
        
        C:\Windows\SysWOW64\nhtkabamjjd.exe
        
        C:\Windows\system32\nhtkabamjjd.exe 2664 "C:\Windows\SysWOW64\ggmktuwqbzb.exe"
        353⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\yzjifrchkhg.exe
        
        C:\Windows\system32\yzjifrchkhg.exe 2732 "C:\Windows\SysWOW64\nhtkabamjjd.exe"
        354⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\lpekvzhwdtt.exe
        
        C:\Windows\system32\lpekvzhwdtt.exe 2668 "C:\Windows\SysWOW64\yzjifrchkhg.exe"
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Windows\SysWOW64\qnbabahzycd.exe
        
        C:\Windows\system32\qnbabahzycd.exe 2504 "C:\Windows\SysWOW64\lpekvzhwdtt.exe"
        356⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\yvwsvpqsgey.exe
        
        C:\Windows\system32\yvwsvpqsgey.exe 2848 "C:\Windows\SysWOW64\qnbabahzycd.exe"
        357⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\yskgzsnktbz.exe
        
        C:\Windows\system32\yskgzsnktbz.exe 2660 "C:\Windows\SysWOW64\yvwsvpqsgey.exe"
        358⤵
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\fafgthxdtlu.exe
        
        C:\Windows\system32\fafgthxdtlu.exe 2864 "C:\Windows\SysWOW64\yskgzsnktbz.exe"
        359⤵
        Checks BIOS information in registry
        
        PID:1580
        
        C:\Windows\SysWOW64\snpvzlwhhkh.exe
        
        C:\Windows\system32\snpvzlwhhkh.exe 2868 "C:\Windows\SysWOW64\fafgthxdtlu.exe"
        360⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\dmbtjkdhhil.exe
        
        C:\Windows\system32\dmbtjkdhhil.exe 2688 "C:\Windows\SysWOW64\snpvzlwhhkh.exe"
        361⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\sqbonxabovg.exe
        
        C:\Windows\system32\sqbonxabovg.exe 2876 "C:\Windows\SysWOW64\dmbtjkdhhil.exe"
        362⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\vxpqdpbxjip.exe
        
        C:\Windows\system32\vxpqdpbxjip.exe 2716 "C:\Windows\SysWOW64\sqbonxabovg.exe"
        363⤵
        Checks BIOS information in registry
        
        PID:3452
        
        C:\Windows\SysWOW64\fsqjkjkdwtt.exe
        
        C:\Windows\system32\fsqjkjkdwtt.exe 2768 "C:\Windows\SysWOW64\vxpqdpbxjip.exe"
        364⤵
        Checks BIOS information in registry
        
        PID:4072
        
        C:\Windows\SysWOW64\ntpjzqgqedn.exe
        
        C:\Windows\system32\ntpjzqgqedn.exe 2840 "C:\Windows\SysWOW64\fsqjkjkdwtt.exe"
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Windows\SysWOW64\vxroijqgrah.exe
        
        C:\Windows\system32\vxroijqgrah.exe 2776 "C:\Windows\SysWOW64\ntpjzqgqedn.exe"
        366⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\dqyoxqmbskj.exe
        
        C:\Windows\system32\dqyoxqmbskj.exe 1288 "C:\Windows\SysWOW64\vxroijqgrah.exe"
        367⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\nmrhfkvynnm.exe
        
        C:\Windows\system32\nmrhfkvynnm.exe 2904 "C:\Windows\SysWOW64\dqyoxqmbskj.exe"
        368⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\azjxkoultuz.exe
        
        C:\Windows\system32\azjxkoultuz.exe 2672 "C:\Windows\SysWOW64\nmrhfkvynnm.exe"
        369⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\dfphagvhogi.exe
        
        C:\Windows\system32\dfphagvhogi.exe 2916 "C:\Windows\SysWOW64\azjxkoultuz.exe"
        370⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\lgozonzcwqc.exe
        
        C:\Windows\system32\lgozonzcwqc.exe 2900 "C:\Windows\SysWOW64\dfphagvhogi.exe"
        371⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\vbpswhaakbf.exe
        
        C:\Windows\system32\vbpswhaakbf.exe 2912 "C:\Windows\SysWOW64\lgozonzcwqc.exe"
        372⤵
        Checks BIOS information in registry
        
        PID:4356
        
        C:\Windows\SysWOW64\idvzhumjpbt.exe
        
        C:\Windows\system32\idvzhumjpbt.exe 2712 "C:\Windows\SysWOW64\vbpswhaakbf.exe"
        373⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\vqmxnylodag.exe
        
        C:\Windows\system32\vqmxnylodag.exe 2708 "C:\Windows\SysWOW64\idvzhumjpbt.exe"
        374⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\yxtadpmsymp.exe
        
        C:\Windows\system32\yxtadpmsymp.exe 2932 "C:\Windows\SysWOW64\vqmxnylodag.exe"
        375⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\feoaxfvkfxk.exe
        
        C:\Windows\system32\feoaxfvkfxk.exe 2812 "C:\Windows\SysWOW64\yxtadpmsymp.exe"
        376⤵
        Drops file in System32 directory
        
        PID:1780
        
        C:\Windows\SysWOW64\vjovbksxmkf.exe
        
        C:\Windows\system32\vjovbksxmkf.exe 2760 "C:\Windows\SysWOW64\feoaxfvkfxk.exe"
        377⤵
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\djvvhzwsmuz.exe
        
        C:\Windows\system32\djvvhzwsmuz.exe 2940 "C:\Windows\SysWOW64\vjovbksxmkf.exe"
        378⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\qaqqqzczngm.exe
        
        C:\Windows\system32\qaqqqzczngm.exe 2936 "C:\Windows\SysWOW64\djvvhzwsmuz.exe"
        379⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\vyngeablahw.exe
        
        C:\Windows\system32\vyngeablahw.exe 2948 "C:\Windows\SysWOW64\qaqqqzczngm.exe"
        380⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\cniyypkvirz.exe
        
        C:\Windows\system32\cniyypkvirz.exe 2956 "C:\Windows\SysWOW64\vyngeablahw.exe"
        381⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\njjqfklavcd.exe
        
        C:\Windows\system32\njjqfklavcd.exe 2720 "C:\Windows\SysWOW64\cniyypkvirz.exe"
        382⤵
        Checks BIOS information in registry
        
        PID:3132
        
        C:\Windows\SysWOW64\shgytlklqkn.exe
        
        C:\Windows\system32\shgytlklqkn.exe 2728 "C:\Windows\SysWOW64\njjqfklavcd.exe"
        383⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\fxbbctqtjxa.exe
        
        C:\Windows\system32\fxbbctqtjxa.exe 2972 "C:\Windows\SysWOW64\shgytlklqkn.exe"
        384⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\nbloletiemu.exe
        
        C:\Windows\system32\nbloletiemu.exe 2568 "C:\Windows\SysWOW64\fxbbctqtjxa.exe"
        385⤵
        Checks BIOS information in registry
        
        PID:4432
        
        C:\Windows\SysWOW64\vnwoukrzfvv.exe
        
        C:\Windows\system32\vnwoukrzfvv.exe 2968 "C:\Windows\SysWOW64\nbloletiemu.exe"
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Windows\SysWOW64\aoejcqxfnrg.exe
        
        C:\Windows\system32\aoejcqxfnrg.exe 2976 "C:\Windows\SysWOW64\vnwoukrzfvv.exe"
        387⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\nnzmtqcugdt.exe
        
        C:\Windows\system32\nnzmtqcugdt.exe 2764 "C:\Windows\SysWOW64\aoejcqxfnrg.exe"
        388⤵
        Drops file in System32 directory
        
        PID:4348
        
        C:\Windows\SysWOW64\qtnxiieqaqc.exe
        
        C:\Windows\system32\qtnxiieqaqc.exe 2988 "C:\Windows\SysWOW64\nnzmtqcugdt.exe"
        389⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\vyheuriyuzo.exe
        
        C:\Windows\system32\vyheuriyuzo.exe 2984 "C:\Windows\SysWOW64\qtnxiieqaqc.exe"
        390⤵
        Checks BIOS information in registry
        
        PID:3380
        
        C:\Windows\SysWOW64\dzfxiymldbp.exe
        
        C:\Windows\system32\dzfxiymldbp.exe 2996 "C:\Windows\SysWOW64\vyheuriyuzo.exe"
        391⤵
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\SysWOW64\sscssupdjwm.exe
        
        C:\Windows\system32\sscssupdjwm.exe 1276 "C:\Windows\SysWOW64\dzfxiymldbp.exe"
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\vvfpfhreqwn.exe
        
        C:\Windows\system32\vvfpfhreqwn.exe 3004 "C:\Windows\SysWOW64\sscssupdjwm.exe"
        393⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\awoknfxsyrg.exe
        
        C:\Windows\system32\awoknfxsyrg.exe 3000 "C:\Windows\SysWOW64\vvfpfhreqwn.exe"
        394⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\abyxeyailga.exe
        
        C:\Windows\system32\abyxeyailga.exe 3052 "C:\Windows\SysWOW64\awoknfxsyrg.exe"
        395⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\nkeahxasntm.exe
        
        C:\Windows\system32\nkeahxasntm.exe 2964 "C:\Windows\SysWOW64\abyxeyailga.exe"
        396⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\sppibzeazbx.exe
        
        C:\Windows\system32\sppibzeazbx.exe 2648 "C:\Windows\SysWOW64\nkeahxasntm.exe"
        397⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\fkhygdlfnbk.exe
        
        C:\Windows\system32\fkhygdlfnbk.exe 2784 "C:\Windows\SysWOW64\sppibzeazbx.exe"
        398⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\iqviwvmjhnt.exe
        
        C:\Windows\system32\iqviwvmjhnt.exe 3016 "C:\Windows\SysWOW64\fkhygdlfnbk.exe"
        399⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Windows\SysWOW64\qgjvafjcvku.exe
        
        C:\Windows\system32\qgjvafjcvku.exe 2816 "C:\Windows\SysWOW64\iqviwvmjhnt.exe"
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Windows\SysWOW64\fcrvmxsowkj.exe
        
        C:\Windows\system32\fcrvmxsowkj.exe 2680 "C:\Windows\SysWOW64\qgjvafjcvku.exe"
        401⤵
        
        PID:920
        
        C:\Windows\SysWOW64\nsfjyaqgkhl.exe
        
        C:\Windows\system32\nsfjyaqgkhl.exe 3040 "C:\Windows\SysWOW64\fcrvmxsowkj.exe"
        402⤵
        
        PID:620
        
        C:\Windows\SysWOW64\vwpwhtawfef.exe
        
        C:\Windows\system32\vwpwhtawfef.exe 3028 "C:\Windows\SysWOW64\nsfjyaqgkhl.exe"
        403⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\aumevmaisfp.exe
        
        C:\Windows\system32\aumevmaisfp.exe 2952 "C:\Windows\SysWOW64\vwpwhtawfef.exe"
        404⤵
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\kpnwcgaffqb.exe
        
        C:\Windows\system32\kpnwcgaffqb.exe 2704 "C:\Windows\SysWOW64\aumevmaisfp.exe"
        405⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\pcgwwqfnzzm.exe
        
        C:\Windows\system32\pcgwwqfnzzm.exe 2800 "C:\Windows\SysWOW64\kpnwcgaffqb.exe"
        406⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\xgqjnbqdmwh.exe
        
        C:\Windows\system32\xgqjnbqdmwh.exe 2820 "C:\Windows\SysWOW64\pcgwwqfnzzm.exe"
        407⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\nhfrgkgvpwc.exe
        
        C:\Windows\system32\nhfrgkgvpwc.exe 2792 "C:\Windows\SysWOW64\xgqjnbqdmwh.exe"
        408⤵
        Drops file in System32 directory
        
        PID:628
        
        C:\Windows\SysWOW64\xkdcbnuxbhg.exe
        
        C:\Windows\system32\xkdcbnuxbhg.exe 2828 "C:\Windows\SysWOW64\nhfrgkgvpwc.exe"
        409⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\ajvmlwqwxuo.exe
        
        C:\Windows\system32\ajvmlwqwxuo.exe 3048 "C:\Windows\SysWOW64\xkdcbnuxbhg.exe"
        410⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\fzrhzkbhdqa.exe
        
        C:\Windows\system32\fzrhzkbhdqa.exe 3068 "C:\Windows\SysWOW64\ajvmlwqwxuo.exe"
        411⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\pvsspfcerte.exe
        
        C:\Windows\system32\pvsspfcerte.exe 2748 "C:\Windows\SysWOW64\fzrhzkbhdqa.exe"
        412⤵
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\sbgcewlilnn.exe
        
        C:\Windows\system32\sbgcewlilnn.exe 3080 "C:\Windows\SysWOW64\pvsspfcerte.exe"
        413⤵
        
        PID:372
        
        C:\Windows\SysWOW64\zufcldhvlxh.exe
        
        C:\Windows\system32\zufcldhvlxh.exe 2856 "C:\Windows\SysWOW64\sbgcewlilnn.exe"
        414⤵
        
        PID:752
        
        C:\Windows\SysWOW64\nppsrhoiawt.exe
        
        C:\Windows\system32\nppsrhoiawt.exe 2872 "C:\Windows\SysWOW64\zufcldhvlxh.exe"
        415⤵
        Checks BIOS information in registry
        
        PID:1104
        
        C:\Windows\SysWOW64\sqxnhemozkm.exe
        
        C:\Windows\system32\sqxnhemozkm.exe 2960 "C:\Windows\SysWOW64\nppsrhoiawt.exe"
        416⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmyfphulnvp.exe
        
        C:\Windows\system32\cmyfphulnvp.exe 3064 "C:\Windows\SysWOW64\sqxnhemozkm.exe"
        417⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\kqilgsxbisk.exe
        
        C:\Windows\system32\kqilgsxbisk.exe 2888 "C:\Windows\SysWOW64\cmyfphulnvp.exe"
        418⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\uiyqlizejqv.exe
        
        C:\Windows\system32\uiyqlizejqv.exe 3108 "C:\Windows\SysWOW64\kqilgsxbisk.exe"
        419⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\fezasdajwby.exe
        
        C:\Windows\system32\fezasdajwby.exe 2844 "C:\Windows\SysWOW64\uiyqlizejqv.exe"
        420⤵
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\kcwqgeznjci.exe
        
        C:\Windows\system32\kcwqgeznjci.exe 3120 "C:\Windows\SysWOW64\fezasdajwby.exe"
        421⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\vxxboyisxnm.exe
        
        C:\Windows\system32\vxxboyisxnm.exe 3172 "C:\Windows\SysWOW64\kcwqgeznjci.exe"
        422⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\azfweegyfjf.exe
        
        C:\Windows\system32\azfweegyfjf.exe 2752 "C:\Windows\SysWOW64\vxxboyisxnm.exe"
        423⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\kyjtwunxfhj.exe
        
        C:\Windows\system32\kyjtwunxfhj.exe 2880 "C:\Windows\SysWOW64\azfweegyfjf.exe"
        424⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\utkmexovskm.exe
        
        C:\Windows\system32\utkmexovskm.exe 3124 "C:\Windows\SysWOW64\kyjtwunxfhj.exe"
        425⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\aodhpmoebge.exe
        
        C:\Windows\system32\aodhpmoebge.exe 2804 "C:\Windows\SysWOW64\utkmexovskm.exe"
        426⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\faxoavbmvop.exe
        
        C:\Windows\system32\faxoavbmvop.exe 2896 "C:\Windows\SysWOW64\aodhpmoebge.exe"
        427⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\snhegzazboc.exe
        
        C:\Windows\system32\snhegzazboc.exe 2980 "C:\Windows\SysWOW64\faxoavbmvop.exe"
        428⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\xaamzbfhvpn.exe
        
        C:\Windows\system32\xaamzbfhvpn.exe 2920 "C:\Windows\SysWOW64\snhegzazboc.exe"
        429⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\ckgxcaerxbh.exe
        
        C:\Windows\system32\ckgxcaerxbh.exe 2836 "C:\Windows\SysWOW64\xaamzbfhvpn.exe"
        430⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\hhlfqbevkjr.exe
        
        C:\Windows\system32\hhlfqbevkjr.exe 3152 "C:\Windows\SysWOW64\ckgxcaerxbh.exe"
        431⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\ppzfkrnnstm.exe
        
        C:\Windows\system32\ppzfkrnnstm.exe 2944 "C:\Windows\SysWOW64\hhlfqbevkjr.exe"
        432⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Windows\SysWOW64\uqhaswttzhf.exe
        
        C:\Windows\system32\uqhaswttzhf.exe 2744 "C:\Windows\SysWOW64\ppzfkrnnstm.exe"
        433⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\kdpvwbqngub.exe
        
        C:\Windows\system32\kdpvwbqngub.exe 3164 "C:\Windows\SysWOW64\uqhaswttzhf.exe"
        434⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\jvqfqwaemgt.exe
        
        C:\Windows\system32\jvqfqwaemgt.exe 3012 "C:\Windows\SysWOW64\kdpvwbqngub.exe"
        435⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\urrxgrbbarx.exe
        
        C:\Windows\system32\urrxgrbbarx.exe 2884 "C:\Windows\SysWOW64\jvqfqwaemgt.exe"
        436⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\cgflktyuwoy.exe
        
        C:\Windows\system32\cgflktyuwoy.exe 3184 "C:\Windows\SysWOW64\urrxgrbbarx.exe"
        437⤵
        Checks BIOS information in registry
        
        PID:5824
        
        C:\Windows\SysWOW64\hhvgayeivkj.exe
        
        C:\Windows\system32\hhvgayeivkj.exe 3180 "C:\Windows\SysWOW64\cgflktyuwoy.exe"
        438⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\rozdlxlawin.exe
        
        C:\Windows\system32\rozdlxlawin.exe 1260 "C:\Windows\SysWOW64\hhvgayeivkj.exe"
        439⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\zenqwaitrxo.exe
        
        C:\Windows\system32\zenqwaitrxo.exe 2928 "C:\Windows\SysWOW64\rozdlxlawin.exe"
        440⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\kzojeuryfis.exe
        
        C:\Windows\system32\kzojeuryfis.exe 2892 "C:\Windows\SysWOW64\zenqwaitrxo.exe"
        441⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\pmhqxewgzrd.exe
        
        C:\Windows\system32\pmhqxewgzrd.exe 3208 "C:\Windows\SysWOW64\kzojeuryfis.exe"
        442⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\czzgdivlfqp.exe
        
        C:\Windows\system32\czzgdivlfqp.exe 3196 "C:\Windows\SysWOW64\pmhqxewgzrd.exe"
        443⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\mroeiyxogoa.exe
        
        C:\Windows\system32\mroeiyxogoa.exe 3036 "C:\Windows\SysWOW64\czzgdivlfqp.exe"
        444⤵
        Checks BIOS information in registry
        Drops file in System32 directory
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\aeybocvtvnn.exe
        
        C:\Windows\system32\aeybocvtvnn.exe 2484 "C:\Windows\SysWOW64\mroeiyxogoa.exe"
        445⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\clmedtwwpzo.exe
        
        C:\Windows\system32\clmedtwwpzo.exe 3024 "C:\Windows\SysWOW64\aeybocvtvnn.exe"
        446⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\kpwruehmcwq.exe
        
        C:\Windows\system32\kpwruehmcwq.exe 3224 "C:\Windows\SysWOW64\clmedtwwpzo.exe"
        447⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\pntzaggyxxb.exe
        
        C:\Windows\system32\pntzaggyxxb.exe 3056 "C:\Windows\SysWOW64\kpwruehmcwq.exe"
        448⤵
        Checks BIOS information in registry
        
        PID:5148
        
        C:\Windows\SysWOW64\udyuwmsaetm.exe
        
        C:\Windows\system32\udyuwmsaetm.exe 2612 "C:\Windows\SysWOW64\pntzaggyxxb.exe"
        449⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\enorjcudfrx.exe
        
        C:\Windows\system32\enorjcudfrx.exe 3084 "C:\Windows\SysWOW64\udyuwmsaetm.exe"
        450⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\pfdxoaoggpa.exe
        
        C:\Windows\system32\pfdxoaoggpa.exe 3232 "C:\Windows\SysWOW64\enorjcudfrx.exe"
        451⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\wnrxapxqfzv.exe
        
        C:\Windows\system32\wnrxapxqfzv.exe 3240 "C:\Windows\SysWOW64\pfdxoaoggpa.exe"
        452⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\hirhpkgvtcz.exe
        
        C:\Windows\system32\hirhpkgvtcz.exe 3244 "C:\Windows\SysWOW64\wnrxapxqfzv.exe"
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Windows\SysWOW64\pgfvtmdogza.exe
        
        C:\Windows\system32\pgfvtmdogza.exe 3256 "C:\Windows\SysWOW64\hirhpkgvtcz.exe"
        454⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\wnbvnknzojv.exe
        
        C:\Windows\system32\wnbvnknzojv.exe 3220 "C:\Windows\SysWOW64\pgfvtmdogza.exe"
        455⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\hxqssahbphy.exe
        
        C:\Windows\system32\hxqssahbphy.exe 3260 "C:\Windows\SysWOW64\wnbvnknzojv.exe"
        456⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\mhynjxnhwvj.exe
        
        C:\Windows\system32\mhynjxnhwvj.exe 3060 "C:\Windows\SysWOW64\hxqssahbphy.exe"
        457⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\uljasqxfjsl.exe
        
        C:\Windows\system32\uljasqxfjsl.exe 3264 "C:\Windows\SysWOW64\mhynjxnhwvj.exe"
        458⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\evygfgrakqo.exe
        
        C:\Windows\system32\evygfgrakqo.exe 2992 "C:\Windows\SysWOW64\uljasqxfjsl.exe"
        459⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\pnodkxtdlor.exe
        
        C:\Windows\system32\pnodkxtdlor.exe 3044 "C:\Windows\SysWOW64\evygfgrakqo.exe"
        460⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\zjhwrruazzu.exe
        
        C:\Windows\system32\zjhwrruazzu.exe 3272 "C:\Windows\SysWOW64\pnodkxtdlor.exe"
        461⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Windows\SysWOW64\hnrbjcfymwp.exe
        
        C:\Windows\system32\hnrbjcfymwp.exe 3100 "C:\Windows\SysWOW64\zjhwrruazzu.exe"
        462⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\prbosvhohlr.exe
        
        C:\Windows\system32\prbosvhohlr.exe 3076 "C:\Windows\SysWOW64\hnrbjcfymwp.exe"
        463⤵
        Checks BIOS information in registry
        
        PID:5956
        
        C:\Windows\SysWOW64\zbrtfljiiju.exe
        
        C:\Windows\system32\zbrtfljiiju.exe 3296 "C:\Windows\SysWOW64\prbosvhohlr.exe"
        464⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\hcqulsfeito.exe
        
        C:\Windows\system32\hcqulsfeito.exe 3020 "C:\Windows\SysWOW64\zbrtfljiiju.exe"
        465⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\edypcylkqgh.exe
        
        C:\Windows\system32\edypcylkqgh.exe 3312 "C:\Windows\SysWOW64\hcqulsfeito.exe"
        466⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\jqrwvhyskps.exe
        
        C:\Windows\system32\jqrwvhyskps.exe 3328 "C:\Windows\SysWOW64\edypcylkqgh.exe"
        467⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\ulshdczpxav.exe
        
        C:\Windows\system32\ulshdczpxav.exe 3088 "C:\Windows\SysWOW64\jqrwvhyskps.exe"
        468⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\cbgugewilxx.exe
        
        C:\Windows\system32\cbgugewilxx.exe 3112 "C:\Windows\SysWOW64\ulshdczpxav.exe"
        469⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\jfqhypzgymr.exe
        
        C:\Windows\system32\jfqhypzgymr.exe 3292 "C:\Windows\SysWOW64\cbgugewilxx.exe"
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\uxgfdfbbzku.exe
        
        C:\Windows\system32\uxgfdfbbzku.exe 3032 "C:\Windows\SysWOW64\jfqhypzgymr.exe"
        471⤵
        Checks BIOS information in registry
        
        PID:5528
        
        C:\Windows\SysWOW64\zkznwpnjttn.exe
        
        C:\Windows\system32\zkznwpnjttn.exe 3148 "C:\Windows\SysWOW64\uxgfdfbbzku.exe"
        472⤵
        Checks BIOS information in registry
        
        PID:5296
        
        C:\Windows\SysWOW64\poziackdagb.exe
        
        C:\Windows\system32\poziackdagb.exe 3316 "C:\Windows\SysWOW64\zkznwpnjttn.exe"
        473⤵
        Checks BIOS information in registry
        
        PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
eaf51d55e97ddf95473df267d486174f

SHA1
1aa428d545555ba0857a8aeac760181193b07be8

SHA256
7b572fab6dba81df5b71295310af1033b7a66e105bbe6d198a89fe76c3b86786

SHA512
07e4b99c16be78e85596d1fc6ca58ff3e30fada9b931cbeea43483d230f985634359b9de56da982ef995ec54f1e0cf7b4b3fe348c01bccdf09a402a770caf0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
9a3fa65dc59b4a6c7ac58e19bf25b8f0

SHA1
2543f7e5082e825c0361945fb673e6e471376d1d

SHA256
6e1cc009a1558200b6eedf20ac0dcdb4066eab58e16a4eee5499671b3722e24e

SHA512
d1ea45e78f45c06468e34877553a9096310eaa6d74a936ea39574224a88fdf4332296c065f0ba5a61f0a3e49e05338ff6507c5e55f76edb4fdab50f1a7c52033

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
4a87d7d1dc74cd804fc31b0cda41c84f

SHA1
444bc39dfffc2c91344f51851e9ccfb86df18d16

SHA256
4d4a3e85cfae81d97ef6713b6905509fa3bb3e47ccc5a5c372718aa7b7b87339

SHA512
b600f158168e68d4258b0f38b1fc8943c56e1cb1f8ef9fe5ed3d8c81f20125aa718e9290fa5d5fa3712a0e4c4cd11e4b563517be125784a8d412df3253fbf282

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
be5bd02216dd1bf1255fd8b2c45de66d

SHA1
0f7e594f0c885e4653d6c434f50f005bd68a92ba

SHA256
9535d940ee1db43ebb271cd9cc7f484318992d12f28e231aaaba68e52fcf0312

SHA512
6c2cc43c85dc908fa936ed371814c36ad6eb049e7e3c005a7c22cd45f4a88e9fb8744051e5f0b0905e4a9cebb3f079c0142674d6c12a14930e741ceddde526c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
6db2483e679114a6df0fb194b56187a2

SHA1
d35a4df627bf2d5a95bf733976c84a806d2d8475

SHA256
765bc4ce70704df838f2598a23c66a42393bf6bb96cc60c6847ea66626e9dc06

SHA512
b8691178bd8a3d2a7b288be9c1f734fa4d26b89f880a67367bb454fcb033cd849c73e1ac5343c4c9b1dd447cedce0c7ef7f51c9bb4a5f03032169cf662b20a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
352244318f398f93c10dfc7e8a2afe28

SHA1
e78b47e75b595a8dd38cfaf3749992e3566122fa

SHA256
6134119dc6ff52a56a136a05aee49793679a3dea5209fde8840608cf87c458d7

SHA512
2a94f0ae1790d1fe894cdcec03fc6f32e48a751599eacc9db025db85a5b8843761dbab48b7f49cea36db8da85bb44af0410fc435b25cbf96708e2c4764eba31e

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
0080b07e25443d034d806a4858448f24

SHA1
39b4878ea9f7e7baca6f8a9fdae5c56903830c8a

SHA256
d2322292f1e6919f605bd23ac331d422d34b6d77734f9cdfb57c35d935463904

SHA512
e4bb76d9ccf5eef8ac1ed9b381d9181f59424aff8dece146b9fc418ffae4d4b9833f882517712718ac0121be1b5af9f75c17f8f99a643d86074e1421f2bc4d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
3949f9395a65eb1eb854a20fb35b6294

SHA1
0c5266114744d33ddcc3d20a66cf79b14e427a0d

SHA256
cf9f0018dd9cf31a85bcf3568d089b13f4437badb28f9b9778be60e3774caabc

SHA512
d17c5e2991428ee0fbdeea33753456a62e96a5c0f581c280aa45a5a88cfd634a5cd13ccf9e8970d5b0206c5106263491861738f0246f1f08b02d16c6a58c83b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
3c9b4b693819e22a714d68d9ee6a2ff8

SHA1
9887d5003703ad32beb83f5c87dcc12e39600385

SHA256
646f2a84ce1e27e436c69f8784c185e9ee09c5a3daf242733a2fb1995c844db4

SHA512
0e9f56e85af790ff0e9e51812b148376ccf4e66a8eda73cb1db47ea7805b09562de48aa2fce52ad8c86473417450a297b6d50a4839f5ff302bc52e40753b15a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
fbba8f5a90cbc38b9d8b953227cca524

SHA1
bb64d9e94c857c75179511dbce51d17453150a7c

SHA256
2374fe1b690bbc8d07627ba4d23d9ae66ba92e411acb83eecd4b2ec3eb3a915a

SHA512
32a5b076841f3e8130faac7dc05dba3de7361d8c3d5266d59b0209d2d77307c8f67e0a24a5a9c47d38ed7fc1dc4a8cfed885fc787a852dc57ed94f670efa557e

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
1d8dcf8ccaf92623f914d3e75c269f7b

SHA1
936b6fd73109e53c7b821a8a00679d344fc931c9

SHA256
23c2fd724379185f0280a9d1a21184a9451a8e1d47037ed9e2bf5edaa3aa6f28

SHA512
734fb0d1a1c6d14e0483aea2f92014ee9fc529a3d8e65c56e7025d444ddae34f678d097caa39b9b77a37d137dc64e5843ef92b0e587cfa6642c87d89ede83995

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
b07be7132d040cb968e4bbffea20e51e

SHA1
73d355b353705584591f2ccaaae52da6d55ecaad

SHA256
ba459171403d152dd66f1f1fdad79dfa160a25268f6dff0a911282673f12a8cd

SHA512
9e080511c29a5520599b322f45e24a4bb7a1dee15636adc05ba00721e4ba051a00598391d97dbf9c880272d844b20561ad84add3482cbe8da8582e21c42473ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
0786e307cad30066e5efcd982a0782f5

SHA1
167fe017548578cc81ad506fcbdec9ef8d9837df

SHA256
d5db43f3504cc29a28aadb7ab308c7ef43cd0ae19bc080d902316ea8aa785f56

SHA512
fe34c5d7745178c2d2cb5661e35e11b51189624f3ba3187120082abca365c060d6ac07a2d04cb46d4fcd34c4b0ffab95b55587381fe05c390096ca0f561bd483

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
1842e7ed993dad44b2de91ff917b9d15

SHA1
2537c547ef5b7d20cbd4dba5e152baa5bc16dc5e

SHA256
e513b1940407d74746e6a4d88185c6d103fc22f21bb7bb3a8c1f91b6384b46a8

SHA512
c8599bbb5a8b121a93d1c28bc453c5f0df1827080050e5c415d1613c0898b36c871b05cc3e2a925ca5a6333794d84fe3702d3c12a25baeb18a63aff9e762c712

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
9ab055195fa9b6386885c33af87839f4

SHA1
e2cfc426609d99717c1ba88b76e8a5e870b8b24a

SHA256
bc7063dcfd0372dac1cc846c4b46146241fcc4ca03e0db8c597dafcd05c7ac0e

SHA512
299e68b72be2d857fce14908652873f38b57af6d828acb4dc20bd6bb6c30e233fe938fdcd654fddecdcb72a6de923fbb6511241e5eda09cd8200bc5e23f933ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
339a125db9f1aea4b5959001c3276f0e

SHA1
0a810abaaa33e7db24606ed4a96ab19a1af454e5

SHA256
3fe81ed769b11cb9b5ef50057274111b063d0767746b66ab35f9ca86d1e21058

SHA512
441cda1708b920b9ab677e605bad114fd3f97e2d23309cf3d5fd8c0e759d6d0e95382448ba6d03e02f6159f06038e58f9d7631c0d26adcbf978b299de2ea3d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
66159d7247ae5e702abaa08797675876

SHA1
c9497a7e07a3542226c7fec9c33ddfa6a3bbe143

SHA256
beecdf69fdcbb1384e8ab55f7ad910943ee2e7e685f1ce819ece817ea7f7c810

SHA512
092b55e705f823be2ce548f0ad39943454edebf66e68c2cac7cea7e774baf791d7c1e093d6c40ff09d6d7386426794c49bbf753463bec1a7a3097e754ee40227

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
8045cbfcd1305d7a3b3e24193340d905

SHA1
8172d297ab4e43c03d79d3c3598112a54706d23a

SHA256
88ab32833424cd47b0dafdebd71f7eaa78c3a451742c946fec9463312346cfb8

SHA512
6a853319d71f0bcaec6fd72f91cdef39d5c62a12090145c0fe6594dafc6bc64a3b14193ecabb83e828e1feee1c5077a5befe1e0aa8008d7b0bbb537ad78c8df4

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
c88f7a01ed0c5bcca1a8dc32d257dbfa

SHA1
a451917cbb5ff56c5e07349efca86b6824f325b8

SHA256
c39acf9b217782c34c8512495261a5e4ab66874e1bd90ba52e767d692ef7a7d5

SHA512
70e99bbdf3259a45562a93a13482429a9e6b3e6da991ad416391b1d1994440ccf954e1f74a945474c9e5ef5b09fc69c0ac5452fb39ddb846361d57b6769da665

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
c1ce411ca882f5a8dbbe6761923759dc

SHA1
8bf0a011a31ae4fb712e28b9b279306bea491313

SHA256
637cc301421c41f2ba4e7a02d9c819aaca855558fb16516f8a4f0b99c491c95d

SHA512
f28f54250e5c9d94770d017574130783dc5a3f3e5b7c5d6065034c6b8293bb22b0825deac14a3927feb49cbc54c4614c913b548b88038f14efd9c5de283244d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
6583c0e7fe8240b052506b4289059402

SHA1
226395694932d30c00c76ddcf01e4ef2429763df

SHA256
adfce1e9d44621e36838eeb819476368bbba6fffcbe53f8c630b5c7f7e47c525

SHA512
c19d1cd04d0557fa6c402ab6d6f46725cb9f684cb7c876c442965127b02d45fd4c107b7df7330469a9e356d5fa15e12285167f4a8ada36099d5273185ba12398

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
51544f303fad4fe6f197c7d1c6570c9e

SHA1
600d2798cf49af74bd41e514236786152cb7bedd

SHA256
0cf2ada5a8457123527d21f402dbb02d40cf436cfc5d1ca3d7608eb9085295f3

SHA512
ee7ee7205c2315838f369a392b33ec3a8ae4264f0a408bfd15a87dfd02967001c80bd0f39d5778ddea0df3c5f8cd6a3fdaeaac03949a1ef1b30721b3a744c8a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
acef923453febe4ca8685810495b0dbc

SHA1
2333513e061d76d681ce1a22fc1f4bf03521a7d5

SHA256
892838ac17261bbb1f8e589240954c497ed1a99a29a967075b1ace3cd33e4468

SHA512
34edddef50377ae6be2c8c07964d66f25a99ef623ab8832163f0c0d1dcebab03201d0c1ae8a1ba34b160ce1b95ace681c870ab8491953b0f95d817f56adfb31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
15c860c0d079cb7949060293f945303e

SHA1
4fb2cdf90eae32e907094ec1c9b91a92fad44383

SHA256
0cee0905a282904b3af499a654c79280cde7d87f69cf07551d69ec657702fde8

SHA512
725206187c2c4680a0252359ee3f84c2deb38bb7ebcd90889217a3daa199b3d8bc42a1c33dec32cfdf81a5f6d78e863712a815ef1cb4245c8818756d2a7054d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
9e9adc74635e673e56b99c39ee7e4a84

SHA1
2619a57bbf333f47f83b83f9d6470e6488ebfacf

SHA256
d3f8fb0a823db30db8dd4f7016989f00e3ed5616d287dd92f6d0ba0c93929fb8

SHA512
f40446414f93e91e1a3b9b482d86e063944a2c344c968c6ab74c4b47f9cc64209835d34b63f32cfa8d6b72594f65559e12146064abb58d78d6440f1d381fb0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
ee2f7dc3c4357d7e90f195e8cd23252d

SHA1
2c4d4317e0034a91972b42b695b6477d86cb2dba

SHA256
cd0a5ba532f08e4f4435089a50fb970c900e829ee60880f92e417a3ee02f0fba

SHA512
5fd36d4b4121d43b5fd869b99fd3afb1dc8cbcd4e039f3107fab4205ed45a19cb44671ff2435185970bfa57f8e698085a9f03a0c1f7a2b868c863c0baa5c0877

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
7df9b64a49abbd8a68c1b5f18d4acc7a

SHA1
d5e54ba3e9df336089ad96a3ed3f6bccc1268f40

SHA256
cccdd08fd3862241f3ea953d53592626fc2e61c66693d40697b15449c74f12fb

SHA512
72e242ae05b4bad29e011d8fde36c0cc9b356bb4c7d55b88dc69ab24eadca962dd30d35bb46f372b6a90f55c065874b0e69e617f47ffddd45682fc9fedc67ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\A59C99D4.TMP

Filesize
110B

MD5
f2da33d81e451e7a5bd82b694a4bca2b

SHA1
d802827697bb3538b7e9df571f10626648a7977c

SHA256
30028899a09f72c1f6a6a373d64226a24648e373f5ed9594de6b5ae10624c9cf

SHA512
be360384c9d883e74fe34b76de8f4b8653c55eed4fc97c86863e88d9951dd7789ba99a41437c33c4512ee776d6f8424f774c5064577b064ec2f29b02566a2da7

Download Submit
C:\Windows\SysWOW64\nslbrpoebvh.exe

Filesize
693KB

MD5
e99f6ab90c467e6f67379912be367664

SHA1
a2236b36e18c46941051590ecbc2f9b81089e7bb

SHA256
dd1b98a578d4c4dac4064b9849630878b95fe9e06a8eb141c8612e660caeacee

SHA512
9718c7d0eecf1f1cd843a59554193857fd9fe8edf23c77f046c9b6f1453ce570a76ebce715ca69ca4268c168d7f4771c97a6163cf07f2e1cc6f0f60217079a89

Download Submit
memory/60-251-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/116-708-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/116-668-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/532-1366-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/556-456-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1036-859-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1260-1338-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1360-1086-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1412-985-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1444-225-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1496-809-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1512-686-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1804-110-0x0000000001FB0000-0x000000000200D000-memory.dmp

Filesize
372KB

Download
memory/1804-164-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-7-0x00000000006C0000-0x000000000071D000-memory.dmp

Filesize
372KB

Download
memory/1932-0-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-13-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-15-0x00000000006C0000-0x000000000071D000-memory.dmp

Filesize
372KB

Download
memory/1932-10-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-9-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-43-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-35-0x00000000006C0000-0x000000000071D000-memory.dmp

Filesize
372KB

Download
memory/1932-2-0x00000000006C0000-0x000000000071D000-memory.dmp

Filesize
372KB

Download
memory/1932-14-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-11-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-12-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1932-8-0x00000000006C0000-0x000000000071D000-memory.dmp

Filesize
372KB

Download
memory/1940-1064-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/1940-1021-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2000-1463-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2008-610-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2020-342-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-94-0x00000000006B0000-0x000000000070D000-memory.dmp

Filesize
372KB

Download
memory/2276-66-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-50-0x00000000006B0000-0x000000000070D000-memory.dmp

Filesize
372KB

Download
memory/2276-58-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-62-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-59-0x00000000006B0000-0x000000000070D000-memory.dmp

Filesize
372KB

Download
memory/2276-67-0x00000000006B0000-0x000000000070D000-memory.dmp

Filesize
372KB

Download
memory/2276-55-0x00000000006B0000-0x000000000070D000-memory.dmp

Filesize
372KB

Download
memory/2276-65-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-61-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-103-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-64-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2276-63-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2388-485-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2432-625-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2452-938-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2592-1388-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2652-795-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2652-834-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2744-582-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/2840-887-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3024-196-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3024-149-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-42-0x00000000005E0000-0x000000000063D000-memory.dmp

Filesize
372KB

Download
memory/3104-23-0x00000000005E0000-0x000000000063D000-memory.dmp

Filesize
372KB

Download
memory/3104-40-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-36-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-34-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-41-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-76-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-37-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-71-0x00000000005E0000-0x000000000063D000-memory.dmp

Filesize
372KB

Download
memory/3104-39-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-29-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3104-30-0x00000000005E0000-0x000000000063D000-memory.dmp

Filesize
372KB

Download
memory/3104-28-0x00000000005E0000-0x000000000063D000-memory.dmp

Filesize
372KB

Download
memory/3184-1313-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3320-528-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3376-559-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-102-0x0000000002150000-0x00000000021AD000-memory.dmp

Filesize
372KB

Download
memory/3504-98-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-89-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-134-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-101-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-80-0x0000000002150000-0x00000000021AD000-memory.dmp

Filesize
372KB

Download
memory/3504-85-0x0000000002150000-0x00000000021AD000-memory.dmp

Filesize
372KB

Download
memory/3504-97-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-88-0x0000000002150000-0x00000000021AD000-memory.dmp

Filesize
372KB

Download
memory/3504-100-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-99-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3504-96-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3528-416-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3540-510-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3596-1112-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3664-282-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3680-733-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3892-1416-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3960-1265-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/3976-1039-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4000-1191-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4000-1149-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4388-1213-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4444-401-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4484-1137-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4484-1097-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4548-311-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4568-786-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4572-660-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4592-1291-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4632-921-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4632-960-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4748-1013-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4888-1438-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/4948-758-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/5000-392-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/5032-1241-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/5088-1166-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download
memory/5096-911-0x0000000000400000-0x00000000005D1000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads