Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe
-
Size
43KB
-
MD5
08034160c327bb95906ebe7bf1dfe448
-
SHA1
9c464ea0b72cf03864e8b006f58646cb04dc00b9
-
SHA256
92d09a697a2e51dcd1ce9d5245e4598da8e074604eb1425b6e7e4347f3ef64df
-
SHA512
05846c34cf499d3ff1525f24bba984df06edd6e3d0e4153c2634dc73eca8ce432041ebf4adaf6b1894050602c325fe62ee7235338ee3ef9a9e4b92daf24635be
-
SSDEEP
768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/Kppl8:3PnAClrVLTrEqNAxvXsf7rzV/KpX8
Malware Config
Signatures
-
Executes dropped EXE 33 IoCs
pid Process 4828 thienvu1996.exe 3044 thienvu1996.exe 5792 thienvu1996.exe 4712 thienvu1996.exe 3588 thienvu1996.exe 2996 thienvu1996.exe 5728 thienvu1996.exe 3612 thienvu1996.exe 4380 thienvu1996.exe 4272 thienvu1996.exe 3372 thienvu1996.exe 3596 thienvu1996.exe 4408 thienvu1996.exe 3976 thienvu1996.exe 936 thienvu1996.exe 1676 thienvu1996.exe 4336 thienvu1996.exe 5788 thienvu1996.exe 5624 thienvu1996.exe 368 thienvu1996.exe 5432 thienvu1996.exe 4952 thienvu1996.exe 5000 thienvu1996.exe 4604 thienvu1996.exe 1764 thienvu1996.exe 3816 thienvu1996.exe 3188 thienvu1996.exe 4852 thienvu1996.exe 1376 thienvu1996.exe 5384 thienvu1996.exe 4452 thienvu1996.exe 5180 thienvu1996.exe 484 thienvu1996.exe -
Adds Run key to start application 2 TTPs 33 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thienvu1996 = "C:\\Windows\\system32\\thienvu1996.exe" thienvu1996.exe -
Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Lock = "WLELock" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Shutdown = "WLEShutdown" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Unlock = "WLEUnlock" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Shutdown = "WLEShutdown" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logon = "WLELogon" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logon = "WLELogon" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StartScreenSaver = "WLEStartScreenSaver" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Impersonate = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Startup = "WLEStartup" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Startup = "WLEStartup" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StopScreenSaver = "WLEStopScreenSaver" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\DllName = "thienvu1996.dll" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logon = "WLELogon" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Shutdown = "WLEShutdown" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Unlock = "WLEUnlock" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Unlock = "WLEUnlock" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StartScreenSaver = "WLEStartScreenSaver" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\DllName = "thienvu1996.dll" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Startup = "WLEStartup" thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Unlock = "WLEUnlock" thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logoff = "WLELogoff" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Impersonate = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Unlock = "WLEUnlock" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Shutdown = "WLEShutdown" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logoff = "WLELogoff" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logon = "WLELogon" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Shutdown = "WLEShutdown" thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logon = "WLELogon" 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StartScreenSaver = "WLEStartScreenSaver" thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Impersonate = "0" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logon = "WLELogon" thienvu1996.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996 thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StartScreenSaver = "WLEStartScreenSaver" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StartScreenSaver = "WLEStartScreenSaver" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\DllName = "thienvu1996.dll" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StopScreenSaver = "WLEStopScreenSaver" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Unlock = "WLEUnlock" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Unlock = "WLEUnlock" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logon = "WLELogon" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\StopScreenSaver = "WLEStopScreenSaver" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Lock = "WLELock" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\DllName = "thienvu1996.dll" thienvu1996.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Asynchronous = "0" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\DllName = "thienvu1996.dll" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logoff = "WLELogoff" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\DllName = "thienvu1996.dll" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Lock = "WLELock" thienvu1996.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\thienvu1996\Logoff = "WLELogoff" thienvu1996.exe -
Drops file in System32 directory 36 IoCs
description ioc Process File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.dll 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File opened for modification C:\Windows\SysWOW64\thienvu1996.exe 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File opened for modification C:\Windows\SysWOW64\thienvu1996.dll 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe File created C:\Windows\SysWOW64\thienvu1996.exe thienvu1996.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 8232 7972 WerFault.exe 303 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 4828 2156 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe 81 PID 2156 wrote to memory of 4828 2156 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe 81 PID 2156 wrote to memory of 4828 2156 08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe 81 PID 4828 wrote to memory of 3044 4828 thienvu1996.exe 82 PID 4828 wrote to memory of 3044 4828 thienvu1996.exe 82 PID 4828 wrote to memory of 3044 4828 thienvu1996.exe 82 PID 3044 wrote to memory of 5792 3044 thienvu1996.exe 83 PID 3044 wrote to memory of 5792 3044 thienvu1996.exe 83 PID 3044 wrote to memory of 5792 3044 thienvu1996.exe 83 PID 5792 wrote to memory of 4712 5792 thienvu1996.exe 84 PID 5792 wrote to memory of 4712 5792 thienvu1996.exe 84 PID 5792 wrote to memory of 4712 5792 thienvu1996.exe 84 PID 4712 wrote to memory of 3588 4712 thienvu1996.exe 85 PID 4712 wrote to memory of 3588 4712 thienvu1996.exe 85 PID 4712 wrote to memory of 3588 4712 thienvu1996.exe 85 PID 3588 wrote to memory of 2996 3588 thienvu1996.exe 86 PID 3588 wrote to memory of 2996 3588 thienvu1996.exe 86 PID 3588 wrote to memory of 2996 3588 thienvu1996.exe 86 PID 2996 wrote to memory of 5728 2996 thienvu1996.exe 87 PID 2996 wrote to memory of 5728 2996 thienvu1996.exe 87 PID 2996 wrote to memory of 5728 2996 thienvu1996.exe 87 PID 5728 wrote to memory of 3612 5728 thienvu1996.exe 88 PID 5728 wrote to memory of 3612 5728 thienvu1996.exe 88 PID 5728 wrote to memory of 3612 5728 thienvu1996.exe 88 PID 3612 wrote to memory of 4380 3612 thienvu1996.exe 89 PID 3612 wrote to memory of 4380 3612 thienvu1996.exe 89 PID 3612 wrote to memory of 4380 3612 thienvu1996.exe 89 PID 4380 wrote to memory of 4272 4380 thienvu1996.exe 90 PID 4380 wrote to memory of 4272 4380 thienvu1996.exe 90 PID 4380 wrote to memory of 4272 4380 thienvu1996.exe 90 PID 4272 wrote to memory of 3372 4272 thienvu1996.exe 91 PID 4272 wrote to memory of 3372 4272 thienvu1996.exe 91 PID 4272 wrote to memory of 3372 4272 thienvu1996.exe 91 PID 3372 wrote to memory of 3596 3372 thienvu1996.exe 92 PID 3372 wrote to memory of 3596 3372 thienvu1996.exe 92 PID 3372 wrote to memory of 3596 3372 thienvu1996.exe 92 PID 3596 wrote to memory of 4408 3596 thienvu1996.exe 93 PID 3596 wrote to memory of 4408 3596 thienvu1996.exe 93 PID 3596 wrote to memory of 4408 3596 thienvu1996.exe 93 PID 4408 wrote to memory of 3976 4408 thienvu1996.exe 94 PID 4408 wrote to memory of 3976 4408 thienvu1996.exe 94 PID 4408 wrote to memory of 3976 4408 thienvu1996.exe 94 PID 3976 wrote to memory of 936 3976 thienvu1996.exe 95 PID 3976 wrote to memory of 936 3976 thienvu1996.exe 95 PID 3976 wrote to memory of 936 3976 thienvu1996.exe 95 PID 936 wrote to memory of 1676 936 thienvu1996.exe 96 PID 936 wrote to memory of 1676 936 thienvu1996.exe 96 PID 936 wrote to memory of 1676 936 thienvu1996.exe 96 PID 1676 wrote to memory of 4336 1676 thienvu1996.exe 97 PID 1676 wrote to memory of 4336 1676 thienvu1996.exe 97 PID 1676 wrote to memory of 4336 1676 thienvu1996.exe 97 PID 4336 wrote to memory of 5788 4336 thienvu1996.exe 98 PID 4336 wrote to memory of 5788 4336 thienvu1996.exe 98 PID 4336 wrote to memory of 5788 4336 thienvu1996.exe 98 PID 5788 wrote to memory of 5624 5788 thienvu1996.exe 99 PID 5788 wrote to memory of 5624 5788 thienvu1996.exe 99 PID 5788 wrote to memory of 5624 5788 thienvu1996.exe 99 PID 5624 wrote to memory of 368 5624 thienvu1996.exe 100 PID 5624 wrote to memory of 368 5624 thienvu1996.exe 100 PID 5624 wrote to memory of 368 5624 thienvu1996.exe 100 PID 368 wrote to memory of 5432 368 thienvu1996.exe 101 PID 368 wrote to memory of 5432 368 thienvu1996.exe 101 PID 368 wrote to memory of 5432 368 thienvu1996.exe 101 PID 5432 wrote to memory of 4952 5432 thienvu1996.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08034160c327bb95906ebe7bf1dfe448_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe12⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe13⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe14⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe15⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe16⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe17⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe18⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe19⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe20⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe21⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe22⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe23⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4952 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe24⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:5000 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe25⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:4604 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe26⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:1764 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe27⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:3816 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe28⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3188 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe29⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:4852 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe30⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:1376 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe31⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:5384 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe32⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:4452 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe33⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:5180 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe34⤵
- Executes dropped EXE
PID:484 -
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe35⤵PID:1232
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe36⤵PID:3624
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe37⤵PID:1980
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe38⤵PID:1936
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe39⤵PID:2044
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe40⤵PID:3020
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe41⤵PID:2472
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe42⤵PID:848
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe43⤵PID:5488
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe44⤵PID:1852
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe45⤵PID:5036
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe46⤵PID:4048
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe47⤵PID:5100
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe48⤵PID:1824
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe49⤵PID:5596
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe50⤵PID:5544
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe51⤵PID:5424
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe52⤵PID:3248
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe53⤵PID:5436
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe54⤵PID:2352
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe55⤵PID:5044
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe56⤵PID:5956
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe57⤵PID:396
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe58⤵PID:1700
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe59⤵PID:4212
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe60⤵PID:4548
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe61⤵PID:1584
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe62⤵PID:572
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe63⤵PID:2684
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe64⤵PID:2420
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe65⤵PID:4912
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe66⤵PID:948
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe67⤵PID:5536
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe68⤵PID:3628
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe69⤵PID:1684
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe70⤵PID:2104
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe71⤵PID:5900
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe72⤵PID:3356
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe73⤵PID:4824
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe74⤵PID:5260
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe75⤵PID:5888
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe76⤵PID:220
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe77⤵PID:2792
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe78⤵PID:5636
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe79⤵PID:5768
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe80⤵PID:1768
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe81⤵PID:4228
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe82⤵PID:3128
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe83⤵PID:752
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe84⤵PID:4684
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe85⤵PID:1184
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe86⤵PID:2164
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe87⤵PID:1904
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe88⤵PID:1316
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe89⤵PID:5136
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe90⤵PID:5460
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe91⤵PID:760
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe92⤵PID:2200
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe93⤵PID:5204
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe94⤵PID:2392
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe95⤵PID:5468
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe96⤵PID:4708
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe97⤵PID:1892
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe98⤵PID:4356
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe99⤵PID:2056
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe100⤵PID:5716
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe101⤵PID:2444
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe102⤵PID:5572
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe103⤵PID:4428
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe104⤵PID:4704
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe105⤵PID:5440
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe106⤵PID:5160
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe107⤵PID:4692
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe108⤵PID:5568
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe109⤵PID:5288
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe110⤵PID:3724
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe111⤵PID:6080
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe112⤵PID:4068
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe113⤵PID:5456
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe114⤵PID:5652
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe115⤵PID:1228
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe116⤵PID:1092
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe117⤵PID:4928
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe118⤵PID:3608
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe119⤵PID:1332
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe120⤵PID:3584
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe121⤵PID:4316
-
C:\Windows\SysWOW64\thienvu1996.exeC:\Windows\system32\thienvu1996.exe122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-