Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 22:57

General

  • Target

    JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe

  • Size

    526KB

  • MD5

    007f1600b0a0777c591f415db8ec29a3

  • SHA1

    76bc884c55c46fa51b804dfc5f6d5a0a2135b9a2

  • SHA256

    cb7c957512e28316854bf79037d88cdd7e349f43340d80ba53668e7974a4cb82

  • SHA512

    b2656f206e161888fe3f798bf757ab6cd95b49424da6219d70ae866e1db52f3f826bb5c647a510b4c9e78d1bc2db05e67b40763b04ffdf3a8818fed1e04bddc4

  • SSDEEP

    12288:SHN3d5HDR40EFZjLDLuluC89Ew5nph2rxxnew80aEL1c0nb4auvhGzY:SHv5jRfEnXiuB9cDeCaERh4a98

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 64 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\SysWOW64\dbel.exe
      C:\Windows\system32\dbel.exe 636 "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\SysWOW64\uidi.exe
        C:\Windows\system32\uidi.exe 612 "C:\Windows\SysWOW64\dbel.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:276
        • C:\Windows\SysWOW64\krqa.exe
          C:\Windows\system32\krqa.exe 616 "C:\Windows\SysWOW64\uidi.exe"
          4⤵
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Windows\SysWOW64\zcvg.exe
            C:\Windows\system32\zcvg.exe 620 "C:\Windows\SysWOW64\krqa.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2136
            • C:\Windows\SysWOW64\fgvd.exe
              C:\Windows\system32\fgvd.exe 640 "C:\Windows\SysWOW64\zcvg.exe"
              6⤵
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2980
              • C:\Windows\SysWOW64\fshw.exe
                C:\Windows\system32\fshw.exe 660 "C:\Windows\SysWOW64\fgvd.exe"
                7⤵
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:376
                • C:\Windows\SysWOW64\fkqo.exe
                  C:\Windows\system32\fkqo.exe 628 "C:\Windows\SysWOW64\fshw.exe"
                  8⤵
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:2384
                  • C:\Windows\SysWOW64\hbww.exe
                    C:\Windows\system32\hbww.exe 632 "C:\Windows\SysWOW64\fkqo.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:2728
                    • C:\Windows\SysWOW64\wzdw.exe
                      C:\Windows\system32\wzdw.exe 624 "C:\Windows\SysWOW64\hbww.exe"
                      10⤵
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:2700
                      • C:\Windows\SysWOW64\blxe.exe
                        C:\Windows\system32\blxe.exe 644 "C:\Windows\SysWOW64\wzdw.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:632
                        • C:\Windows\SysWOW64\dzzg.exe
                          C:\Windows\system32\dzzg.exe 652 "C:\Windows\SysWOW64\blxe.exe"
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:440
                          • C:\Windows\SysWOW64\doxm.exe
                            C:\Windows\system32\doxm.exe 668 "C:\Windows\SysWOW64\dzzg.exe"
                            13⤵
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:2584
                            • C:\Windows\SysWOW64\shug.exe
                              C:\Windows\system32\shug.exe 736 "C:\Windows\SysWOW64\doxm.exe"
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:1408
                              • C:\Windows\SysWOW64\zphz.exe
                                C:\Windows\system32\zphz.exe 740 "C:\Windows\SysWOW64\shug.exe"
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in System32 directory
                                • Suspicious use of WriteProcessMemory
                                PID:2240
                                • C:\Windows\SysWOW64\hqgz.exe
                                  C:\Windows\system32\hqgz.exe 656 "C:\Windows\SysWOW64\zphz.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of WriteProcessMemory
                                  PID:708
                                  • C:\Windows\SysWOW64\mjwz.exe
                                    C:\Windows\system32\mjwz.exe 708 "C:\Windows\SysWOW64\hqgz.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:1692
                                    • C:\Windows\SysWOW64\myme.exe
                                      C:\Windows\system32\myme.exe 664 "C:\Windows\SysWOW64\mjwz.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2892
                                      • C:\Windows\SysWOW64\dnkj.exe
                                        C:\Windows\system32\dnkj.exe 756 "C:\Windows\SysWOW64\myme.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        PID:2588
                                        • C:\Windows\SysWOW64\omph.exe
                                          C:\Windows\system32\omph.exe 764 "C:\Windows\SysWOW64\dnkj.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:300
                                          • C:\Windows\SysWOW64\bzge.exe
                                            C:\Windows\system32\bzge.exe 768 "C:\Windows\SysWOW64\omph.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            PID:2380
                                            • C:\Windows\SysWOW64\ljvh.exe
                                              C:\Windows\system32\ljvh.exe 772 "C:\Windows\SysWOW64\bzge.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:2364
                                              • C:\Windows\SysWOW64\viim.exe
                                                C:\Windows\system32\viim.exe 792 "C:\Windows\SysWOW64\ljvh.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:2868
                                                • C:\Windows\SysWOW64\izcp.exe
                                                  C:\Windows\system32\izcp.exe 776 "C:\Windows\SysWOW64\viim.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:988
                                                  • C:\Windows\SysWOW64\phqh.exe
                                                    C:\Windows\system32\phqh.exe 780 "C:\Windows\SysWOW64\izcp.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2512
                                                    • C:\Windows\SysWOW64\cftk.exe
                                                      C:\Windows\system32\cftk.exe 760 "C:\Windows\SysWOW64\phqh.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Drops file in System32 directory
                                                      PID:2268
                                                      • C:\Windows\SysWOW64\jqrp.exe
                                                        C:\Windows\system32\jqrp.exe 788 "C:\Windows\SysWOW64\cftk.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:1516
                                                        • C:\Windows\SysWOW64\wpmr.exe
                                                          C:\Windows\system32\wpmr.exe 796 "C:\Windows\SysWOW64\jqrp.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:2688
                                                          • C:\Windows\SysWOW64\goyp.exe
                                                            C:\Windows\system32\goyp.exe 800 "C:\Windows\SysWOW64\wpmr.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:2848
                                                            • C:\Windows\SysWOW64\tets.exe
                                                              C:\Windows\system32\tets.exe 784 "C:\Windows\SysWOW64\goyp.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2896
                                                              • C:\Windows\SysWOW64\dlfp.exe
                                                                C:\Windows\system32\dlfp.exe 812 "C:\Windows\SysWOW64\tets.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:1176
                                                                • C:\Windows\SysWOW64\novz.exe
                                                                  C:\Windows\system32\novz.exe 808 "C:\Windows\SysWOW64\dlfp.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Drops file in System32 directory
                                                                  PID:2836
                                                                  • C:\Windows\SysWOW64\ykns.exe
                                                                    C:\Windows\system32\ykns.exe 820 "C:\Windows\SysWOW64\novz.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    PID:2204
                                                                    • C:\Windows\SysWOW64\kaqn.exe
                                                                      C:\Windows\system32\kaqn.exe 816 "C:\Windows\SysWOW64\ykns.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      PID:1800
                                                                      • C:\Windows\SysWOW64\stpa.exe
                                                                        C:\Windows\system32\stpa.exe 832 "C:\Windows\SysWOW64\kaqn.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        PID:3048
                                                                        • C:\Windows\SysWOW64\fkkc.exe
                                                                          C:\Windows\system32\fkkc.exe 824 "C:\Windows\SysWOW64\stpa.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          PID:2824
                                                                          • C:\Windows\SysWOW64\pjwa.exe
                                                                            C:\Windows\system32\pjwa.exe 828 "C:\Windows\SysWOW64\fkkc.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1240
                                                                            • C:\Windows\SysWOW64\chrc.exe
                                                                              C:\Windows\system32\chrc.exe 836 "C:\Windows\SysWOW64\pjwa.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              PID:2764
                                                                              • C:\Windows\SysWOW64\mdsn.exe
                                                                                C:\Windows\system32\mdsn.exe 840 "C:\Windows\SysWOW64\chrc.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                PID:2068
                                                                                • C:\Windows\SysWOW64\wrsk.exe
                                                                                  C:\Windows\system32\wrsk.exe 804 "C:\Windows\SysWOW64\mdsn.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2084
                                                                                  • C:\Windows\SysWOW64\gqwi.exe
                                                                                    C:\Windows\system32\gqwi.exe 848 "C:\Windows\SysWOW64\wrsk.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2340
                                                                                    • C:\Windows\SysWOW64\thrk.exe
                                                                                      C:\Windows\system32\thrk.exe 844 "C:\Windows\SysWOW64\gqwi.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      PID:1924
                                                                                      • C:\Windows\SysWOW64\dgdi.exe
                                                                                        C:\Windows\system32\dgdi.exe 856 "C:\Windows\SysWOW64\thrk.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2392
                                                                                        • C:\Windows\SysWOW64\qeyk.exe
                                                                                          C:\Windows\system32\qeyk.exe 860 "C:\Windows\SysWOW64\dgdi.exe"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1616
                                                                                          • C:\Windows\SysWOW64\aazv.exe
                                                                                            C:\Windows\system32\aazv.exe 852 "C:\Windows\SysWOW64\qeyk.exe"
                                                                                            45⤵
                                                                                              PID:2788
                                                                                              • C:\Windows\SysWOW64\ncfl.exe
                                                                                                C:\Windows\system32\ncfl.exe 864 "C:\Windows\SysWOW64\aazv.exe"
                                                                                                46⤵
                                                                                                • Executes dropped EXE
                                                                                                • Identifies Wine through registry keys
                                                                                                • Drops file in System32 directory
                                                                                                PID:2100
                                                                                                • C:\Windows\SysWOW64\xeuv.exe
                                                                                                  C:\Windows\system32\xeuv.exe 872 "C:\Windows\SysWOW64\ncfl.exe"
                                                                                                  47⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2708
                                                                                                  • C:\Windows\SysWOW64\jgal.exe
                                                                                                    C:\Windows\system32\jgal.exe 876 "C:\Windows\SysWOW64\xeuv.exe"
                                                                                                    48⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    PID:2036
                                                                                                    • C:\Windows\SysWOW64\wxvf.exe
                                                                                                      C:\Windows\system32\wxvf.exe 884 "C:\Windows\SysWOW64\jgal.exe"
                                                                                                      49⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Identifies Wine through registry keys
                                                                                                      PID:2360
                                                                                                      • C:\Windows\SysWOW64\jnyi.exe
                                                                                                        C:\Windows\system32\jnyi.exe 880 "C:\Windows\SysWOW64\wxvf.exe"
                                                                                                        50⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Identifies Wine through registry keys
                                                                                                        PID:568
                                                                                                        • C:\Windows\SysWOW64\ujza.exe
                                                                                                          C:\Windows\system32\ujza.exe 900 "C:\Windows\SysWOW64\jnyi.exe"
                                                                                                          51⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:372
                                                                                                          • C:\Windows\SysWOW64\vxsq.exe
                                                                                                            C:\Windows\system32\vxsq.exe 868 "C:\Windows\SysWOW64\ujza.exe"
                                                                                                            52⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Identifies Wine through registry keys
                                                                                                            PID:1544
                                                                                                            • C:\Windows\SysWOW64\ikjn.exe
                                                                                                              C:\Windows\system32\ikjn.exe 896 "C:\Windows\SysWOW64\vxsq.exe"
                                                                                                              53⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Identifies Wine through registry keys
                                                                                                              PID:2876
                                                                                                              • C:\Windows\SysWOW64\vmpv.exe
                                                                                                                C:\Windows\system32\vmpv.exe 888 "C:\Windows\SysWOW64\ikjn.exe"
                                                                                                                54⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2656
                                                                                                                • C:\Windows\SysWOW64\fltt.exe
                                                                                                                  C:\Windows\system32\fltt.exe 908 "C:\Windows\SysWOW64\vmpv.exe"
                                                                                                                  55⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Identifies Wine through registry keys
                                                                                                                  • Drops file in System32 directory
                                                                                                                  PID:2660
                                                                                                                  • C:\Windows\SysWOW64\snhi.exe
                                                                                                                    C:\Windows\system32\snhi.exe 904 "C:\Windows\SysWOW64\fltt.exe"
                                                                                                                    56⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:1300
                                                                                                                    • C:\Windows\SysWOW64\cjab.exe
                                                                                                                      C:\Windows\system32\cjab.exe 892 "C:\Windows\SysWOW64\snhi.exe"
                                                                                                                      57⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2128
                                                                                                                      • C:\Windows\SysWOW64\mlqd.exe
                                                                                                                        C:\Windows\system32\mlqd.exe 928 "C:\Windows\SysWOW64\cjab.exe"
                                                                                                                        58⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2636
                                                                                                                        • C:\Windows\SysWOW64\wsci.exe
                                                                                                                          C:\Windows\system32\wsci.exe 920 "C:\Windows\SysWOW64\mlqd.exe"
                                                                                                                          59⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2196
                                                                                                                          • C:\Windows\SysWOW64\jmiq.exe
                                                                                                                            C:\Windows\system32\jmiq.exe 916 "C:\Windows\SysWOW64\wsci.exe"
                                                                                                                            60⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1576
                                                                                                                            • C:\Windows\SysWOW64\tumo.exe
                                                                                                                              C:\Windows\system32\tumo.exe 932 "C:\Windows\SysWOW64\jmiq.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1760
                                                                                                                              • C:\Windows\SysWOW64\ghdl.exe
                                                                                                                                C:\Windows\system32\ghdl.exe 912 "C:\Windows\SysWOW64\tumo.exe"
                                                                                                                                62⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:2044
                                                                                                                                • C:\Windows\SysWOW64\qgij.exe
                                                                                                                                  C:\Windows\system32\qgij.exe 940 "C:\Windows\SysWOW64\ghdl.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1436
                                                                                                                                  • C:\Windows\SysWOW64\dioq.exe
                                                                                                                                    C:\Windows\system32\dioq.exe 924 "C:\Windows\SysWOW64\qgij.exe"
                                                                                                                                    64⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                    PID:2444
                                                                                                                                    • C:\Windows\SysWOW64\nklb.exe
                                                                                                                                      C:\Windows\system32\nklb.exe 948 "C:\Windows\SysWOW64\dioq.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1828
                                                                                                                                      • C:\Windows\SysWOW64\axvy.exe
                                                                                                                                        C:\Windows\system32\axvy.exe 936 "C:\Windows\SysWOW64\nklb.exe"
                                                                                                                                        66⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:2884
                                                                                                                                        • C:\Windows\SysWOW64\kikb.exe
                                                                                                                                          C:\Windows\system32\kikb.exe 964 "C:\Windows\SysWOW64\axvy.exe"
                                                                                                                                          67⤵
                                                                                                                                            PID:2212
                                                                                                                                            • C:\Windows\SysWOW64\cpmo.exe
                                                                                                                                              C:\Windows\system32\cpmo.exe 944 "C:\Windows\SysWOW64\kikb.exe"
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2264
                                                                                                                                              • C:\Windows\SysWOW64\mvnl.exe
                                                                                                                                                C:\Windows\system32\mvnl.exe 960 "C:\Windows\SysWOW64\cpmo.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                PID:2696
                                                                                                                                                • C:\Windows\SysWOW64\zuqo.exe
                                                                                                                                                  C:\Windows\system32\zuqo.exe 956 "C:\Windows\SysWOW64\mvnl.exe"
                                                                                                                                                  70⤵
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  PID:3052
                                                                                                                                                  • C:\Windows\SysWOW64\mkkj.exe
                                                                                                                                                    C:\Windows\system32\mkkj.exe 968 "C:\Windows\SysWOW64\zuqo.exe"
                                                                                                                                                    71⤵
                                                                                                                                                      PID:2676
                                                                                                                                                      • C:\Windows\SysWOW64\zjfm.exe
                                                                                                                                                        C:\Windows\system32\zjfm.exe 972 "C:\Windows\SysWOW64\mkkj.exe"
                                                                                                                                                        72⤵
                                                                                                                                                          PID:912
                                                                                                                                                          • C:\Windows\SysWOW64\mzio.exe
                                                                                                                                                            C:\Windows\system32\mzio.exe 976 "C:\Windows\SysWOW64\zjfm.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1716
                                                                                                                                                            • C:\Windows\SysWOW64\vnjm.exe
                                                                                                                                                              C:\Windows\system32\vnjm.exe 952 "C:\Windows\SysWOW64\mzio.exe"
                                                                                                                                                              74⤵
                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                              PID:2608
                                                                                                                                                              • C:\Windows\SysWOW64\iedo.exe
                                                                                                                                                                C:\Windows\system32\iedo.exe 988 "C:\Windows\SysWOW64\vnjm.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                PID:2112
                                                                                                                                                                • C:\Windows\SysWOW64\vcyr.exe
                                                                                                                                                                  C:\Windows\system32\vcyr.exe 984 "C:\Windows\SysWOW64\iedo.exe"
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:676
                                                                                                                                                                    • C:\Windows\SysWOW64\ittu.exe
                                                                                                                                                                      C:\Windows\system32\ittu.exe 996 "C:\Windows\SysWOW64\vcyr.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                        PID:2328
                                                                                                                                                                        • C:\Windows\SysWOW64\vjww.exe
                                                                                                                                                                          C:\Windows\system32\vjww.exe 992 "C:\Windows\SysWOW64\ittu.exe"
                                                                                                                                                                          78⤵
                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                          PID:1956
                                                                                                                                                                          • C:\Windows\SysWOW64\fxwm.exe
                                                                                                                                                                            C:\Windows\system32\fxwm.exe 752 "C:\Windows\SysWOW64\vjww.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1448
                                                                                                                                                                            • C:\Windows\SysWOW64\swro.exe
                                                                                                                                                                              C:\Windows\system32\swro.exe 1004 "C:\Windows\SysWOW64\fxwm.exe"
                                                                                                                                                                              80⤵
                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                              PID:1424
                                                                                                                                                                              • C:\Windows\SysWOW64\fmmr.exe
                                                                                                                                                                                C:\Windows\system32\fmmr.exe 1016 "C:\Windows\SysWOW64\swro.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                  PID:2732
                                                                                                                                                                                  • C:\Windows\SysWOW64\rdpu.exe
                                                                                                                                                                                    C:\Windows\system32\rdpu.exe 1000 "C:\Windows\SysWOW64\fmmr.exe"
                                                                                                                                                                                    82⤵
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    PID:576
                                                                                                                                                                                    • C:\Windows\SysWOW64\ebkw.exe
                                                                                                                                                                                      C:\Windows\system32\ebkw.exe 1032 "C:\Windows\SysWOW64\rdpu.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                        PID:2200
                                                                                                                                                                                        • C:\Windows\SysWOW64\ohku.exe
                                                                                                                                                                                          C:\Windows\system32\ohku.exe 1012 "C:\Windows\SysWOW64\ebkw.exe"
                                                                                                                                                                                          84⤵
                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                          PID:1032
                                                                                                                                                                                          • C:\Windows\SysWOW64\bgfx.exe
                                                                                                                                                                                            C:\Windows\system32\bgfx.exe 1020 "C:\Windows\SysWOW64\ohku.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                              PID:2060
                                                                                                                                                                                              • C:\Windows\SysWOW64\owiz.exe
                                                                                                                                                                                                C:\Windows\system32\owiz.exe 1028 "C:\Windows\SysWOW64\bgfx.exe"
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                  • C:\Windows\SysWOW64\yhxc.exe
                                                                                                                                                                                                    C:\Windows\system32\yhxc.exe 1036 "C:\Windows\SysWOW64\owiz.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                      • C:\Windows\SysWOW64\lyse.exe
                                                                                                                                                                                                        C:\Windows\system32\lyse.exe 1040 "C:\Windows\SysWOW64\yhxc.exe"
                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        PID:2616
                                                                                                                                                                                                        • C:\Windows\SysWOW64\ywnh.exe
                                                                                                                                                                                                          C:\Windows\system32\ywnh.exe 1056 "C:\Windows\SysWOW64\lyse.exe"
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                          • C:\Windows\SysWOW64\knqk.exe
                                                                                                                                                                                                            C:\Windows\system32\knqk.exe 1044 "C:\Windows\SysWOW64\ywnh.exe"
                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                              PID:2336
                                                                                                                                                                                                              • C:\Windows\SysWOW64\xdlm.exe
                                                                                                                                                                                                                C:\Windows\system32\xdlm.exe 1048 "C:\Windows\SysWOW64\knqk.exe"
                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                PID:2672
                                                                                                                                                                                                                • C:\Windows\SysWOW64\hrlk.exe
                                                                                                                                                                                                                  C:\Windows\system32\hrlk.exe 1052 "C:\Windows\SysWOW64\xdlm.exe"
                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\uqgm.exe
                                                                                                                                                                                                                      C:\Windows\system32\uqgm.exe 1060 "C:\Windows\SysWOW64\hrlk.exe"
                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hgjp.exe
                                                                                                                                                                                                                        C:\Windows\system32\hgjp.exe 1064 "C:\Windows\SysWOW64\uqgm.exe"
                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                        PID:2816
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\uxes.exe
                                                                                                                                                                                                                          C:\Windows\system32\uxes.exe 1072 "C:\Windows\SysWOW64\hgjp.exe"
                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:1792
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hvyv.exe
                                                                                                                                                                                                                            C:\Windows\system32\hvyv.exe 1076 "C:\Windows\SysWOW64\uxes.exe"
                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                              PID:672
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\qjzk.exe
                                                                                                                                                                                                                                C:\Windows\system32\qjzk.exe 1092 "C:\Windows\SysWOW64\hvyv.exe"
                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1748
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\daun.exe
                                                                                                                                                                                                                                  C:\Windows\system32\daun.exe 1068 "C:\Windows\SysWOW64\qjzk.exe"
                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\qqxp.exe
                                                                                                                                                                                                                                    C:\Windows\system32\qqxp.exe 1080 "C:\Windows\SysWOW64\daun.exe"
                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vprs.exe
                                                                                                                                                                                                                                        C:\Windows\system32\vprs.exe 1084 "C:\Windows\SysWOW64\qqxp.exe"
                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\frhc.exe
                                                                                                                                                                                                                                            C:\Windows\system32\frhc.exe 1096 "C:\Windows\SysWOW64\vprs.exe"
                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sqkf.exe
                                                                                                                                                                                                                                              C:\Windows\system32\sqkf.exe 1088 "C:\Windows\SysWOW64\frhc.exe"
                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:2576
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\fgei.exe
                                                                                                                                                                                                                                                C:\Windows\system32\fgei.exe 1104 "C:\Windows\SysWOW64\sqkf.exe"
                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                  PID:2568
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sfzk.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\sfzk.exe 1100 "C:\Windows\SysWOW64\fgei.exe"
                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                      PID:2920
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\blaa.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\blaa.exe 1108 "C:\Windows\SysWOW64\sfzk.exe"
                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2028
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ojvc.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\ojvc.exe 1112 "C:\Windows\SysWOW64\blaa.exe"
                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                          PID:2232
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bayf.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\bayf.exe 1116 "C:\Windows\SysWOW64\ojvc.exe"
                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\oysi.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\oysi.exe 1120 "C:\Windows\SysWOW64\bayf.exe"
                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                PID:1984
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ybis.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\ybis.exe 1128 "C:\Windows\SysWOW64\oysi.exe"
                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                    PID:1364
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\lrlv.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\lrlv.exe 1124 "C:\Windows\SysWOW64\ybis.exe"
                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1476
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\yqfy.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\yqfy.exe 1132 "C:\Windows\SysWOW64\lrlv.exe"
                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\lgaa.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\lgaa.exe 1136 "C:\Windows\SysWOW64\yqfy.exe"
                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                            PID:1292
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\uvbq.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\uvbq.exe 1144 "C:\Windows\SysWOW64\lgaa.exe"
                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                PID:2248
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hlws.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\hlws.exe 1140 "C:\Windows\SysWOW64\uvbq.exe"
                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                    PID:2072
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ukyv.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\ukyv.exe 1152 "C:\Windows\SysWOW64\hlws.exe"
                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2132
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\haty.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\haty.exe 1008 "C:\Windows\SysWOW64\ukyv.exe"
                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2412
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\uzoa.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\uzoa.exe 1160 "C:\Windows\SysWOW64\haty.exe"
                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:2408
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\efpy.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\efpy.exe 1156 "C:\Windows\SysWOW64\uzoa.exe"
                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3024
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rdra.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\rdra.exe 1164 "C:\Windows\SysWOW64\efpy.exe"
                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\dumd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\dumd.exe 1168 "C:\Windows\SysWOW64\rdra.exe"
                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                  PID:2308
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\qshg.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\qshg.exe 1176 "C:\Windows\SysWOW64\dumd.exe"
                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\djkj.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\djkj.exe 1172 "C:\Windows\SysWOW64\qshg.exe"
                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                        PID:2776
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\nxly.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\nxly.exe 1180 "C:\Windows\SysWOW64\djkj.exe"
                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:1780
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\anfb.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\anfb.exe 1184 "C:\Windows\SysWOW64\nxly.exe"
                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                              PID:1400
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\nmad.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\nmad.exe 1200 "C:\Windows\SysWOW64\anfb.exe"
                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                PID:1168
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\acdg.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\acdg.exe 1188 "C:\Windows\SysWOW64\nmad.exe"
                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ntyj.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ntyj.exe 1196 "C:\Windows\SysWOW64\acdg.exe"
                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                      PID:1108
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\whyg.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\whyg.exe 1192 "C:\Windows\SysWOW64\ntyj.exe"
                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        PID:1004
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\jftb.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\jftb.exe 1204 "C:\Windows\SysWOW64\whyg.exe"
                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                            PID:1704
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wwod.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wwod.exe 1208 "C:\Windows\SysWOW64\jftb.exe"
                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                              PID:1812
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\jmrg.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\jmrg.exe 1212 "C:\Windows\SysWOW64\wwod.exe"
                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wlmj.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wlmj.exe 1216 "C:\Windows\SysWOW64\jmrg.exe"
                                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                                    PID:780
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\gzmg.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\gzmg.exe 1232 "C:\Windows\SysWOW64\wlmj.exe"
                                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sphj.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sphj.exe 1220 "C:\Windows\SysWOW64\gzmg.exe"
                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\fgkm.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\fgkm.exe 1228 "C:\Windows\SysWOW64\sphj.exe"
                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:1744
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sefo.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\sefo.exe 1224 "C:\Windows\SysWOW64\fgkm.exe"
                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                              PID:2592
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\fvzr.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\fvzr.exe 1236 "C:\Windows\SysWOW64\sefo.exe"
                                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                PID:1020
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\pjag.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\pjag.exe 1240 "C:\Windows\SysWOW64\fvzr.exe"
                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                  PID:2668
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\czvj.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\czvj.exe 1244 "C:\Windows\SysWOW64\pjag.exe"
                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1964
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\pyym.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\pyym.exe 1148 "C:\Windows\SysWOW64\czvj.exe"
                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                        PID:2908
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\coto.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\coto.exe 1264 "C:\Windows\SysWOW64\pyym.exe"
                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\onnr.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\onnr.exe 1252 "C:\Windows\SysWOW64\coto.exe"
                                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1472
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ytoo.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ytoo.exe 1260 "C:\Windows\SysWOW64\onnr.exe"
                                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:264
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\lsrr.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\lsrr.exe 1256 "C:\Windows\SysWOW64\ytoo.exe"
                                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\yimm.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\yimm.exe 1272 "C:\Windows\SysWOW64\lsrr.exe"
                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                      PID:1772
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lggp.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\lggp.exe 1268 "C:\Windows\SysWOW64\yimm.exe"
                                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1600
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\yxjr.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\yxjr.exe 1280 "C:\Windows\SysWOW64\lggp.exe"
                                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1540
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hlcp.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hlcp.exe 1276 "C:\Windows\SysWOW64\yxjr.exe"
                                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                PID:1524
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ucfr.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ucfr.exe 1288 "C:\Windows\SysWOW64\hlcp.exe"
                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\zazu.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\zazu.exe 1284 "C:\Windows\SysWOW64\ucfr.exe"
                                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3016
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mrux.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\mrux.exe 1292 "C:\Windows\SysWOW64\zazu.exe"
                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\zhxz.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\zhxz.exe 1296 "C:\Windows\SysWOW64\mrux.exe"
                                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1228
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\jvyp.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\jvyp.exe 1300 "C:\Windows\SysWOW64\zhxz.exe"
                                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wusr.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wusr.exe 1304 "C:\Windows\SysWOW64\jvyp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\jknu.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\jknu.exe 1312 "C:\Windows\SysWOW64\wusr.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\snle.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\snle.exe 1308 "C:\Windows\SysWOW64\jknu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\flfh.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\flfh.exe 1320 "C:\Windows\SysWOW64\snle.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\scak.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\scak.exe 1316 "C:\Windows\SysWOW64\flfh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\favn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\favn.exe 1336 "C:\Windows\SysWOW64\scak.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                PID:112
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sryp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\sryp.exe 1324 "C:\Windows\SysWOW64\favn.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\fpts.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\fpts.exe 1248 "C:\Windows\SysWOW64\sryp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\pvth.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\pvth.exe 1332 "C:\Windows\SysWOW64\fpts.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cuok.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cuok.exe 1340 "C:\Windows\SysWOW64\pvth.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\okrn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\okrn.exe 1344 "C:\Windows\SysWOW64\cuok.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\bjmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\bjmp.exe 1348 "C:\Windows\SysWOW64\okrn.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ozhs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ozhs.exe 1352 "C:\Windows\SysWOW64\bjmp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ynhp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ynhp.exe 1356 "C:\Windows\SysWOW64\ozhs.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\leks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\leks.exe 1360 "C:\Windows\SysWOW64\ynhp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ycfv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ycfv.exe 1368 "C:\Windows\SysWOW64\leks.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ltax.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ltax.exe 1364 "C:\Windows\SysWOW64\ycfv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\yjca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\yjca.exe 1376 "C:\Windows\SysWOW64\ltax.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hxvq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hxvq.exe 1372 "C:\Windows\SysWOW64\yjca.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\uoys.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\uoys.exe 1392 "C:\Windows\SysWOW64\hxvq.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hmtv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hmtv.exe 1384 "C:\Windows\SysWOW64\uoys.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\udoy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\udoy.exe 1380 "C:\Windows\SysWOW64\hmtv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hbqa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hbqa.exe 1388 "C:\Windows\SysWOW64\udoy.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\riry.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\riry.exe 1396 "C:\Windows\SysWOW64\hbqa.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\dgms.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\dgms.exe 1400 "C:\Windows\SysWOW64\riry.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\qxhv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\qxhv.exe 1408 "C:\Windows\SysWOW64\dgms.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\dvjy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\dvjy.exe 1404 "C:\Windows\SysWOW64\qxhv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\qmea.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\qmea.exe 1412 "C:\Windows\SysWOW64\dvjy.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\awul.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\awul.exe 1328 "C:\Windows\SysWOW64\qmea.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\nnoo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\nnoo.exe 1416 "C:\Windows\SysWOW64\awul.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\apud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\apud.exe 1424 "C:\Windows\SysWOW64\nnoo.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\nfxg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\nfxg.exe 1428 "C:\Windows\SysWOW64\apud.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\aesj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\aesj.exe 1432 "C:\Windows\SysWOW64\nfxg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\jkty.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\jkty.exe 1436 "C:\Windows\SysWOW64\aesj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\winb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\winb.exe 1440 "C:\Windows\SysWOW64\jkty.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\jzqd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\jzqd.exe 1448 "C:\Windows\SysWOW64\winb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wplg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wplg.exe 1444 "C:\Windows\SysWOW64\jzqd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\jogj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\jogj.exe 1456 "C:\Windows\SysWOW64\wplg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\schg.exe 1452 "C:\Windows\SysWOW64\jogj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\fsjj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\fsjj.exe 1464 "C:\Windows\SysWOW64\schg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sjed.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\sjed.exe 1460 "C:\Windows\SysWOW64\fsjj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\fhzg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\fhzg.exe 1468 "C:\Windows\SysWOW64\sjed.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sycj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\sycj.exe 1472 "C:\Windows\SysWOW64\fhzg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmug.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmug.exe 1476 "C:\Windows\SysWOW64\sycj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\pcxj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\pcxj.exe 1480 "C:\Windows\SysWOW64\cmug.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\uxhz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\uxhz.exe 1496 "C:\Windows\SysWOW64\pcxj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ddhw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ddhw.exe 1484 "C:\Windows\SysWOW64\uxhz.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\qckz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\qckz.exe 1492 "C:\Windows\SysWOW64\ddhw.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\dsfb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\dsfb.exe 1488 "C:\Windows\SysWOW64\qckz.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\qrae.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\qrae.exe 1512 "C:\Windows\SysWOW64\dsfb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\aupg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\aupg.exe 1500 "C:\Windows\SysWOW64\qrae.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\nksj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\nksj.exe 1508 "C:\Windows\SysWOW64\aupg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ajnm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ajnm.exe 1504 "C:\Windows\SysWOW64\nksj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\nzio.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\nzio.exe 1528 "C:\Windows\SysWOW64\ajnm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wnim.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wnim.exe 1516 "C:\Windows\SysWOW64\nzio.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\jelp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\jelp.exe 1520 "C:\Windows\SysWOW64\wnim.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wcgr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wcgr.exe 1524 "C:\Windows\SysWOW64\jelp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\jtbu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\jtbu.exe 1532 "C:\Windows\SysWOW64\wcgr.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wrdx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wrdx.exe 1536 "C:\Windows\SysWOW64\jtbu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\gxwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\gxwm.exe 1544 "C:\Windows\SysWOW64\wrdx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\twzp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\twzp.exe 1540 "C:\Windows\SysWOW64\gxwm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gmur.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\gmur.exe 1556 "C:\Windows\SysWOW64\twzp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\tlpu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\tlpu.exe 1548 "C:\Windows\SysWOW64\gmur.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\fbrx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\fbrx.exe 1560 "C:\Windows\SysWOW64\tlpu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ppsu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ppsu.exe 1552 "C:\Windows\SysWOW64\fbrx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cgnx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cgnx.exe 1564 "C:\Windows\SysWOW64\ppsu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\peir.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\peir.exe 1568 "C:\Windows\SysWOW64\cgnx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cvku.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cvku.exe 1576 "C:\Windows\SysWOW64\peir.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\plfx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\plfx.exe 1572 "C:\Windows\SysWOW64\cvku.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\yzgu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\yzgu.exe 1588 "C:\Windows\SysWOW64\plfx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\lybx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\lybx.exe 1580 "C:\Windows\SysWOW64\yzgu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ylsn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ylsn.exe 1592 "C:\Windows\SysWOW64\lybx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\iztk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\iztk.exe 1584 "C:\Windows\SysWOW64\ylsn.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vpon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\vpon.exe 1596 "C:\Windows\SysWOW64\iztk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\igip.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\igip.exe 1600 "C:\Windows\SysWOW64\vpon.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vels.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\vels.exe 1604 "C:\Windows\SysWOW64\igip.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ivgn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ivgn.exe 1608 "C:\Windows\SysWOW64\vels.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rjhk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rjhk.exe 1624 "C:\Windows\SysWOW64\ivgn.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ezcn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ezcn.exe 1612 "C:\Windows\SysWOW64\rjhk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rywq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rywq.exe 1616 "C:\Windows\SysWOW64\ezcn.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\eozs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\eozs.exe 1620 "C:\Windows\SysWOW64\rywq.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rnuv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\rnuv.exe 1628 "C:\Windows\SysWOW64\eozs.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\btvk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\btvk.exe 1632 "C:\Windows\SysWOW64\rnuv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ospn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ospn.exe 1644 "C:\Windows\SysWOW64\btvk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\bisq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\bisq.exe 1636 "C:\Windows\SysWOW64\ospn.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\nhns.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\nhns.exe 1648 "C:\Windows\SysWOW64\bisq.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\axiv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\axiv.exe 1640 "C:\Windows\SysWOW64\nhns.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\klis.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\klis.exe 1652 "C:\Windows\SysWOW64\axiv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\xclv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\xclv.exe 1656 "C:\Windows\SysWOW64\klis.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\kpvl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\kpvl.exe 1664 "C:\Windows\SysWOW64\xclv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\udvi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\udvi.exe 1660 "C:\Windows\SysWOW64\kpvl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\htql.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\htql.exe 1676 "C:\Windows\SysWOW64\udvi.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ustg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ustg.exe 1668 "C:\Windows\SysWOW64\htql.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\duiq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\duiq.exe 1420 "C:\Windows\SysWOW64\ustg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lhjl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\lhjl.exe 1680 "C:\Windows\SysWOW64\duiq.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vnji.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\vnji.exe 1696 "C:\Windows\SysWOW64\lhjl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ilml.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ilml.exe 1684 "C:\Windows\SysWOW64\vnji.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vcho.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\vcho.exe 1688 "C:\Windows\SysWOW64\ilml.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\iacq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\iacq.exe 1692 "C:\Windows\SysWOW64\vcho.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\vrft.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\vrft.exe 1700 "C:\Windows\SysWOW64\iacq.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\efxi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\efxi.exe 1704 "C:\Windows\SysWOW64\vrft.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rval.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\rval.exe 1708 "C:\Windows\SysWOW64\efxi.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\euvo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\euvo.exe 1672 "C:\Windows\SysWOW64\rval.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rkqq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\rkqq.exe 1720 "C:\Windows\SysWOW64\euvo.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ebst.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ebst.exe 1716 "C:\Windows\SysWOW64\rkqq.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\optr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\optr.exe 1736 "C:\Windows\SysWOW64\ebst.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\bnot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\bnot.exe 1724 "C:\Windows\SysWOW64\optr.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\nejw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\nejw.exe 1728 "C:\Windows\SysWOW64\bnot.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\aulr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\aulr.exe 1732 "C:\Windows\SysWOW64\nejw.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ntgt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ntgt.exe 1748 "C:\Windows\SysWOW64\aulr.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\xhhr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\xhhr.exe 1740 "C:\Windows\SysWOW64\ntgt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\kyct.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\kyct.exe 1760 "C:\Windows\SysWOW64\xhhr.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\xoww.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\xoww.exe 1744 "C:\Windows\SysWOW64\kyct.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\knzz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\knzz.exe 1752 "C:\Windows\SysWOW64\xoww.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\xdub.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\xdub.exe 1756 "C:\Windows\SysWOW64\knzz.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\grvr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\grvr.exe 1776 "C:\Windows\SysWOW64\xdub.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\tiqu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\tiqu.exe 1764 "C:\Windows\SysWOW64\grvr.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ggsw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ggsw.exe 1772 "C:\Windows\SysWOW64\tiqu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\txnz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\txnz.exe 1768 "C:\Windows\SysWOW64\ggsw.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\gvic.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\gvic.exe 1712 "C:\Windows\SysWOW64\txnz.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\qbjz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\qbjz.exe 1784 "C:\Windows\SysWOW64\gvic.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\calc.exe 1788 "C:\Windows\SysWOW64\qbjz.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3032

                                                                                                                                                                                                    Network

                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                    • C:\Windows\SysWOW64\dbel.exe

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      526KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      007f1600b0a0777c591f415db8ec29a3

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      76bc884c55c46fa51b804dfc5f6d5a0a2135b9a2

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      cb7c957512e28316854bf79037d88cdd7e349f43340d80ba53668e7974a4cb82

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      b2656f206e161888fe3f798bf757ab6cd95b49424da6219d70ae866e1db52f3f826bb5c647a510b4c9e78d1bc2db05e67b40763b04ffdf3a8818fed1e04bddc4

                                                                                                                                                                                                    • memory/276-34-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/276-50-0x00000000048D0000-0x0000000004AA9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/276-47-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/276-48-0x00000000048D0000-0x0000000004AA9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/276-42-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/276-36-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/300-259-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/372-471-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/376-110-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/376-106-0x0000000004800000-0x00000000049D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/376-107-0x0000000004800000-0x00000000049D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/376-95-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/440-187-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/440-163-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/568-464-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/632-165-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/632-150-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/632-162-0x00000000048C0000-0x0000000004A99000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/708-228-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/708-213-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/988-287-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1176-335-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1240-377-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1300-506-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1408-199-0x00000000048A0000-0x0000000004A79000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1408-202-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1436-555-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1516-307-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1544-478-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1576-535-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1616-420-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1692-236-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1692-226-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1728-16-0x0000000004880000-0x0000000004A59000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1728-13-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1728-2-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1728-15-0x0000000004880000-0x0000000004A59000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1728-0-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1728-1-0x0000000000401000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      160KB

                                                                                                                                                                                                    • memory/1728-6-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1760-541-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1800-356-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/1924-412-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2036-450-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2044-548-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2068-391-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2084-398-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2088-57-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2088-66-0x0000000004910000-0x0000000004AE9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2088-51-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2088-53-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2088-58-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2088-67-0x0000000004910000-0x0000000004AE9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2100-436-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2128-513-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2136-83-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2136-80-0x0000000004810000-0x00000000049E9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2136-68-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2196-527-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2204-349-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2240-212-0x0000000004830000-0x0000000004A09000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2240-215-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2268-300-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2340-405-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2360-457-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2364-272-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2380-266-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2384-124-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2384-121-0x00000000048A0000-0x0000000004A79000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2384-122-0x00000000048A0000-0x0000000004A79000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2392-419-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2444-564-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2512-293-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2584-192-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2588-251-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2636-520-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2656-492-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2660-499-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2688-314-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2700-144-0x00000000048B0000-0x0000000004A89000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2700-151-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2700-136-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2708-443-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2728-138-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2728-123-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2728-134-0x0000000004810000-0x00000000049E9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2736-31-0x00000000048B0000-0x0000000004A89000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2736-17-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2736-19-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2736-33-0x00000000048B0000-0x0000000004A89000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2736-24-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2736-23-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2764-384-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2788-429-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2824-370-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2836-342-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2848-321-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2868-279-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2876-485-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2892-246-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2896-328-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2980-96-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2980-81-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/2980-93-0x0000000004800000-0x00000000049D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                    • memory/3048-363-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.8MB