Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 07:39

General

  • Target

    2f7f5560775949053f1e60fc602d52fc_JaffaCakes118.exe

  • Size

    313KB

  • MD5

    2f7f5560775949053f1e60fc602d52fc

  • SHA1

    0079a814e1806cddf9a94f3cb66f8f6040dd0deb

  • SHA256

    c50bc0ecfb7b78a952b0225bc3c616dacd83eb4626cef8aec8be08a3e1596171

  • SHA512

    f19765d7e49e782bd43e44293d3ffcabc67f6dd4d069de3fdae78f04524ee5b20bf4aea1f428050db6eb0a4fc78cc24c1ab79fc71d2247286fcfb15522cde009

  • SSDEEP

    6144:rdw2CsbZ5kp/Llj8aG8Rty29F0duOd028hfTQzAdvMqzMjm/ZpS:pw2CsbZ5kNR8aVRsE6duHTk4vMwMjm/u

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f7f5560775949053f1e60fc602d52fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f7f5560775949053f1e60fc602d52fc_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Users\Admin\AppData\Local\Temp\2f7f5560775949053f1e60fc602d52fc_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2f7f5560775949053f1e60fc602d52fc_JaffaCakes118.exe"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\xnvjvko.exe
        C:\Windows\system32\xnvjvko.exe 1000 "C:\Users\Admin\AppData\Local\Temp\2f7f5560775949053f1e60fc602d52fc_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\SysWOW64\xnvjvko.exe
          "C:\Windows\SysWOW64\xnvjvko.exe" 1000 "C:\Users\Admin\AppData\Local\Temp\2f7f5560775949053f1e60fc602d52fc_JaffaCakes118.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:1132
          • C:\Windows\SysWOW64\nwtszqe.exe
            C:\Windows\system32\nwtszqe.exe 1016 "C:\Windows\SysWOW64\xnvjvko.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3480
            • C:\Windows\SysWOW64\nwtszqe.exe
              "C:\Windows\SysWOW64\nwtszqe.exe" 1016 "C:\Windows\SysWOW64\xnvjvko.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:4872
              • C:\Windows\SysWOW64\bmmoteo.exe
                C:\Windows\system32\bmmoteo.exe 1032 "C:\Windows\SysWOW64\nwtszqe.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3936
                • C:\Windows\SysWOW64\bmmoteo.exe
                  "C:\Windows\SysWOW64\bmmoteo.exe" 1032 "C:\Windows\SysWOW64\nwtszqe.exe"
                  8⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:3384
                  • C:\Windows\SysWOW64\cuwknoc.exe
                    C:\Windows\system32\cuwknoc.exe 1032 "C:\Windows\SysWOW64\bmmoteo.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:4284
                    • C:\Windows\SysWOW64\cuwknoc.exe
                      "C:\Windows\SysWOW64\cuwknoc.exe" 1032 "C:\Windows\SysWOW64\bmmoteo.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:3200
                      • C:\Windows\SysWOW64\kketsfw.exe
                        C:\Windows\system32\kketsfw.exe 1016 "C:\Windows\SysWOW64\cuwknoc.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:4028
                        • C:\Windows\SysWOW64\kketsfw.exe
                          "C:\Windows\SysWOW64\kketsfw.exe" 1016 "C:\Windows\SysWOW64\cuwknoc.exe"
                          12⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Suspicious use of WriteProcessMemory
                          PID:1644
                          • C:\Windows\SysWOW64\mbwrtlu.exe
                            C:\Windows\system32\mbwrtlu.exe 1156 "C:\Windows\SysWOW64\kketsfw.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of WriteProcessMemory
                            PID:3432
                            • C:\Windows\SysWOW64\mbwrtlu.exe
                              "C:\Windows\SysWOW64\mbwrtlu.exe" 1156 "C:\Windows\SysWOW64\kketsfw.exe"
                              14⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Suspicious use of WriteProcessMemory
                              PID:4384
                              • C:\Windows\SysWOW64\jplacux.exe
                                C:\Windows\system32\jplacux.exe 1148 "C:\Windows\SysWOW64\mbwrtlu.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious use of WriteProcessMemory
                                PID:1708
                                • C:\Windows\SysWOW64\jplacux.exe
                                  "C:\Windows\SysWOW64\jplacux.exe" 1148 "C:\Windows\SysWOW64\mbwrtlu.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:1484
                                  • C:\Windows\SysWOW64\hujygyu.exe
                                    C:\Windows\system32\hujygyu.exe 1156 "C:\Windows\SysWOW64\jplacux.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:4740
                                    • C:\Windows\SysWOW64\hujygyu.exe
                                      "C:\Windows\SysWOW64\hujygyu.exe" 1156 "C:\Windows\SysWOW64\jplacux.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      PID:2988
                                      • C:\Windows\SysWOW64\orfhjyu.exe
                                        C:\Windows\system32\orfhjyu.exe 1156 "C:\Windows\SysWOW64\hujygyu.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:5112
                                        • C:\Windows\SysWOW64\orfhjyu.exe
                                          "C:\Windows\SysWOW64\orfhjyu.exe" 1156 "C:\Windows\SysWOW64\hujygyu.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          PID:3352
                                          • C:\Windows\SysWOW64\tiwkifq.exe
                                            C:\Windows\system32\tiwkifq.exe 1016 "C:\Windows\SysWOW64\orfhjyu.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:1288
                                            • C:\Windows\SysWOW64\tiwkifq.exe
                                              "C:\Windows\SysWOW64\tiwkifq.exe" 1016 "C:\Windows\SysWOW64\orfhjyu.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              PID:1724
                                              • C:\Windows\SysWOW64\wwlenhh.exe
                                                C:\Windows\system32\wwlenhh.exe 1032 "C:\Windows\SysWOW64\tiwkifq.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                PID:1028
                                                • C:\Windows\SysWOW64\wwlenhh.exe
                                                  "C:\Windows\SysWOW64\wwlenhh.exe" 1032 "C:\Windows\SysWOW64\tiwkifq.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  PID:1172
                                                  • C:\Windows\SysWOW64\wajrvai.exe
                                                    C:\Windows\system32\wajrvai.exe 1032 "C:\Windows\SysWOW64\wwlenhh.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:2924
                                                    • C:\Windows\SysWOW64\wajrvai.exe
                                                      "C:\Windows\SysWOW64\wajrvai.exe" 1032 "C:\Windows\SysWOW64\wwlenhh.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      PID:2420
                                                      • C:\Windows\SysWOW64\qoydbcz.exe
                                                        C:\Windows\system32\qoydbcz.exe 1040 "C:\Windows\SysWOW64\wajrvai.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4264
                                                        • C:\Windows\SysWOW64\qoydbcz.exe
                                                          "C:\Windows\SysWOW64\qoydbcz.exe" 1040 "C:\Windows\SysWOW64\wajrvai.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          PID:4604
                                                          • C:\Windows\SysWOW64\yirybya.exe
                                                            C:\Windows\system32\yirybya.exe 1156 "C:\Windows\SysWOW64\qoydbcz.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:408
                                                            • C:\Windows\SysWOW64\yirybya.exe
                                                              "C:\Windows\SysWOW64\yirybya.exe" 1156 "C:\Windows\SysWOW64\qoydbcz.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              PID:3324
                                                              • C:\Windows\SysWOW64\gqrhypu.exe
                                                                C:\Windows\system32\gqrhypu.exe 1148 "C:\Windows\SysWOW64\yirybya.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:456
                                                                • C:\Windows\SysWOW64\gqrhypu.exe
                                                                  "C:\Windows\SysWOW64\gqrhypu.exe" 1148 "C:\Windows\SysWOW64\yirybya.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  PID:3704
                                                                  • C:\Windows\SysWOW64\ldxgcsj.exe
                                                                    C:\Windows\system32\ldxgcsj.exe 1156 "C:\Windows\SysWOW64\gqrhypu.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:2492
                                                                    • C:\Windows\SysWOW64\ldxgcsj.exe
                                                                      "C:\Windows\SysWOW64\ldxgcsj.exe" 1156 "C:\Windows\SysWOW64\gqrhypu.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:5024
                                                                      • C:\Windows\SysWOW64\qxrwdem.exe
                                                                        C:\Windows\system32\qxrwdem.exe 1160 "C:\Windows\SysWOW64\ldxgcsj.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:3792
                                                                        • C:\Windows\SysWOW64\qxrwdem.exe
                                                                          "C:\Windows\SysWOW64\qxrwdem.exe" 1160 "C:\Windows\SysWOW64\ldxgcsj.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          PID:3164
                                                                          • C:\Windows\SysWOW64\noiacui.exe
                                                                            C:\Windows\system32\noiacui.exe 1040 "C:\Windows\SysWOW64\qxrwdem.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:4532
                                                                            • C:\Windows\SysWOW64\noiacui.exe
                                                                              "C:\Windows\SysWOW64\noiacui.exe" 1040 "C:\Windows\SysWOW64\qxrwdem.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              PID:3560
                                                                              • C:\Windows\SysWOW64\sikqmgd.exe
                                                                                C:\Windows\system32\sikqmgd.exe 1032 "C:\Windows\SysWOW64\noiacui.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                PID:4772
                                                                                • C:\Windows\SysWOW64\sikqmgd.exe
                                                                                  "C:\Windows\SysWOW64\sikqmgd.exe" 1032 "C:\Windows\SysWOW64\noiacui.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5104
                                                                                  • C:\Windows\SysWOW64\ysecfnt.exe
                                                                                    C:\Windows\system32\ysecfnt.exe 1144 "C:\Windows\SysWOW64\sikqmgd.exe"
                                                                                    41⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:1356
                                                                                    • C:\Windows\SysWOW64\ysecfnt.exe
                                                                                      "C:\Windows\SysWOW64\ysecfnt.exe" 1144 "C:\Windows\SysWOW64\sikqmgd.exe"
                                                                                      42⤵
                                                                                        PID:4608
                                                                                        • C:\Windows\SysWOW64\lrjfykz.exe
                                                                                          C:\Windows\system32\lrjfykz.exe 1156 "C:\Windows\SysWOW64\ysecfnt.exe"
                                                                                          43⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:3168
                                                                                          • C:\Windows\SysWOW64\lrjfykz.exe
                                                                                            "C:\Windows\SysWOW64\lrjfykz.exe" 1156 "C:\Windows\SysWOW64\ysecfnt.exe"
                                                                                            44⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            PID:2344
                                                                                            • C:\Windows\SysWOW64\iwowcww.exe
                                                                                              C:\Windows\system32\iwowcww.exe 1152 "C:\Windows\SysWOW64\lrjfykz.exe"
                                                                                              45⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:3964
                                                                                              • C:\Windows\SysWOW64\iwowcww.exe
                                                                                                "C:\Windows\SysWOW64\iwowcww.exe" 1152 "C:\Windows\SysWOW64\lrjfykz.exe"
                                                                                                46⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5064
                                                                                                • C:\Windows\SysWOW64\nqjmeir.exe
                                                                                                  C:\Windows\system32\nqjmeir.exe 1016 "C:\Windows\SysWOW64\iwowcww.exe"
                                                                                                  47⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  PID:4256
                                                                                                  • C:\Windows\SysWOW64\nqjmeir.exe
                                                                                                    "C:\Windows\SysWOW64\nqjmeir.exe" 1016 "C:\Windows\SysWOW64\iwowcww.exe"
                                                                                                    48⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    PID:3100
                                                                                                    • C:\Windows\SysWOW64\xbkncfq.exe
                                                                                                      C:\Windows\system32\xbkncfq.exe 1032 "C:\Windows\SysWOW64\nqjmeir.exe"
                                                                                                      49⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:4820
                                                                                                      • C:\Windows\SysWOW64\xbkncfq.exe
                                                                                                        "C:\Windows\SysWOW64\xbkncfq.exe" 1032 "C:\Windows\SysWOW64\nqjmeir.exe"
                                                                                                        50⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4560
                                                                                                        • C:\Windows\SysWOW64\ibibxfi.exe
                                                                                                          C:\Windows\system32\ibibxfi.exe 1180 "C:\Windows\SysWOW64\xbkncfq.exe"
                                                                                                          51⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          PID:1820
                                                                                                          • C:\Windows\SysWOW64\ibibxfi.exe
                                                                                                            "C:\Windows\SysWOW64\ibibxfi.exe" 1180 "C:\Windows\SysWOW64\xbkncfq.exe"
                                                                                                            52⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in System32 directory
                                                                                                            PID:1584
                                                                                                            • C:\Windows\SysWOW64\qvtpxbb.exe
                                                                                                              C:\Windows\system32\qvtpxbb.exe 1032 "C:\Windows\SysWOW64\ibibxfi.exe"
                                                                                                              53⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:1692
                                                                                                              • C:\Windows\SysWOW64\qvtpxbb.exe
                                                                                                                "C:\Windows\SysWOW64\qvtpxbb.exe" 1032 "C:\Windows\SysWOW64\ibibxfi.exe"
                                                                                                                54⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                PID:4732
                                                                                                                • C:\Windows\SysWOW64\ayvqvfa.exe
                                                                                                                  C:\Windows\system32\ayvqvfa.exe 1032 "C:\Windows\SysWOW64\qvtpxbb.exe"
                                                                                                                  55⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  PID:4636
                                                                                                                  • C:\Windows\SysWOW64\ayvqvfa.exe
                                                                                                                    "C:\Windows\SysWOW64\ayvqvfa.exe" 1032 "C:\Windows\SysWOW64\qvtpxbb.exe"
                                                                                                                    56⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:2616
                                                                                                                    • C:\Windows\SysWOW64\avrzgfz.exe
                                                                                                                      C:\Windows\system32\avrzgfz.exe 1016 "C:\Windows\SysWOW64\ayvqvfa.exe"
                                                                                                                      57⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      PID:4840
                                                                                                                      • C:\Windows\SysWOW64\avrzgfz.exe
                                                                                                                        "C:\Windows\SysWOW64\avrzgfz.exe" 1016 "C:\Windows\SysWOW64\ayvqvfa.exe"
                                                                                                                        58⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:452
                                                                                                                        • C:\Windows\SysWOW64\kupfbgr.exe
                                                                                                                          C:\Windows\system32\kupfbgr.exe 1028 "C:\Windows\SysWOW64\avrzgfz.exe"
                                                                                                                          59⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:1628
                                                                                                                          • C:\Windows\SysWOW64\kupfbgr.exe
                                                                                                                            "C:\Windows\SysWOW64\kupfbgr.exe" 1028 "C:\Windows\SysWOW64\avrzgfz.exe"
                                                                                                                            60⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1376
                                                                                                                            • C:\Windows\SysWOW64\vfrgzci.exe
                                                                                                                              C:\Windows\system32\vfrgzci.exe 1040 "C:\Windows\SysWOW64\kupfbgr.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:1392
                                                                                                                              • C:\Windows\SysWOW64\vfrgzci.exe
                                                                                                                                "C:\Windows\SysWOW64\vfrgzci.exe" 1040 "C:\Windows\SysWOW64\kupfbgr.exe"
                                                                                                                                62⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1972
                                                                                                                                • C:\Windows\SysWOW64\crcbzyj.exe
                                                                                                                                  C:\Windows\system32\crcbzyj.exe 1148 "C:\Windows\SysWOW64\vfrgzci.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  PID:2148
                                                                                                                                  • C:\Windows\SysWOW64\crcbzyj.exe
                                                                                                                                    "C:\Windows\SysWOW64\crcbzyj.exe" 1148 "C:\Windows\SysWOW64\vfrgzci.exe"
                                                                                                                                    64⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2924
                                                                                                                                    • C:\Windows\SysWOW64\mjauclf.exe
                                                                                                                                      C:\Windows\system32\mjauclf.exe 1016 "C:\Windows\SysWOW64\crcbzyj.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      PID:4144
                                                                                                                                      • C:\Windows\SysWOW64\mjauclf.exe
                                                                                                                                        "C:\Windows\SysWOW64\mjauclf.exe" 1016 "C:\Windows\SysWOW64\crcbzyj.exe"
                                                                                                                                        66⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:4440
                                                                                                                                        • C:\Windows\SysWOW64\sihgwnv.exe
                                                                                                                                          C:\Windows\system32\sihgwnv.exe 1148 "C:\Windows\SysWOW64\mjauclf.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          PID:3924
                                                                                                                                          • C:\Windows\SysWOW64\sihgwnv.exe
                                                                                                                                            "C:\Windows\SysWOW64\sihgwnv.exe" 1148 "C:\Windows\SysWOW64\mjauclf.exe"
                                                                                                                                            68⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:2380
                                                                                                                                            • C:\Windows\SysWOW64\ulszhys.exe
                                                                                                                                              C:\Windows\system32\ulszhys.exe 1000 "C:\Windows\SysWOW64\sihgwnv.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              PID:1964
                                                                                                                                              • C:\Windows\SysWOW64\ulszhys.exe
                                                                                                                                                "C:\Windows\SysWOW64\ulszhys.exe" 1000 "C:\Windows\SysWOW64\sihgwnv.exe"
                                                                                                                                                70⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:876
                                                                                                                                                • C:\Windows\SysWOW64\cxduhtt.exe
                                                                                                                                                  C:\Windows\system32\cxduhtt.exe 1148 "C:\Windows\SysWOW64\ulszhys.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  PID:3912
                                                                                                                                                  • C:\Windows\SysWOW64\cxduhtt.exe
                                                                                                                                                    "C:\Windows\SysWOW64\cxduhtt.exe" 1148 "C:\Windows\SysWOW64\ulszhys.exe"
                                                                                                                                                    72⤵
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:2436
                                                                                                                                                    • C:\Windows\SysWOW64\hnuygbp.exe
                                                                                                                                                      C:\Windows\system32\hnuygbp.exe 1032 "C:\Windows\SysWOW64\cxduhtt.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      PID:4056
                                                                                                                                                      • C:\Windows\SysWOW64\hnuygbp.exe
                                                                                                                                                        "C:\Windows\SysWOW64\hnuygbp.exe" 1032 "C:\Windows\SysWOW64\cxduhtt.exe"
                                                                                                                                                        74⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:624
                                                                                                                                                        • C:\Windows\SysWOW64\medbnjl.exe
                                                                                                                                                          C:\Windows\system32\medbnjl.exe 1016 "C:\Windows\SysWOW64\hnuygbp.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          PID:4516
                                                                                                                                                          • C:\Windows\SysWOW64\medbnjl.exe
                                                                                                                                                            "C:\Windows\SysWOW64\medbnjl.exe" 1016 "C:\Windows\SysWOW64\hnuygbp.exe"
                                                                                                                                                            76⤵
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            PID:4952
                                                                                                                                                            • C:\Windows\SysWOW64\mqwxmem.exe
                                                                                                                                                              C:\Windows\system32\mqwxmem.exe 1032 "C:\Windows\SysWOW64\medbnjl.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              PID:2696
                                                                                                                                                              • C:\Windows\SysWOW64\mqwxmem.exe
                                                                                                                                                                "C:\Windows\SysWOW64\mqwxmem.exe" 1032 "C:\Windows\SysWOW64\medbnjl.exe"
                                                                                                                                                                78⤵
                                                                                                                                                                  PID:4640
                                                                                                                                                                  • C:\Windows\SysWOW64\rhfblui.exe
                                                                                                                                                                    C:\Windows\system32\rhfblui.exe 1156 "C:\Windows\SysWOW64\mqwxmem.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    PID:3192
                                                                                                                                                                    • C:\Windows\SysWOW64\rhfblui.exe
                                                                                                                                                                      "C:\Windows\SysWOW64\rhfblui.exe" 1156 "C:\Windows\SysWOW64\mqwxmem.exe"
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      PID:4636
                                                                                                                                                                      • C:\Windows\SysWOW64\bodphms.exe
                                                                                                                                                                        C:\Windows\system32\bodphms.exe 1016 "C:\Windows\SysWOW64\rhfblui.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        PID:2340
                                                                                                                                                                        • C:\Windows\SysWOW64\bodphms.exe
                                                                                                                                                                          "C:\Windows\SysWOW64\bodphms.exe" 1016 "C:\Windows\SysWOW64\rhfblui.exe"
                                                                                                                                                                          82⤵
                                                                                                                                                                            PID:3732
                                                                                                                                                                            • C:\Windows\SysWOW64\jdzxrmr.exe
                                                                                                                                                                              C:\Windows\system32\jdzxrmr.exe 1148 "C:\Windows\SysWOW64\bodphms.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              PID:1116
                                                                                                                                                                              • C:\Windows\SysWOW64\jdzxrmr.exe
                                                                                                                                                                                "C:\Windows\SysWOW64\jdzxrmr.exe" 1148 "C:\Windows\SysWOW64\bodphms.exe"
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                PID:2704
                                                                                                                                                                                • C:\Windows\SysWOW64\tpbqprq.exe
                                                                                                                                                                                  C:\Windows\system32\tpbqprq.exe 1032 "C:\Windows\SysWOW64\jdzxrmr.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  PID:1736
                                                                                                                                                                                  • C:\Windows\SysWOW64\tpbqprq.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\tpbqprq.exe" 1032 "C:\Windows\SysWOW64\jdzxrmr.exe"
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    PID:4512
                                                                                                                                                                                    • C:\Windows\SysWOW64\tammpnj.exe
                                                                                                                                                                                      C:\Windows\system32\tammpnj.exe 1148 "C:\Windows\SysWOW64\tpbqprq.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      PID:3372
                                                                                                                                                                                      • C:\Windows\SysWOW64\tammpnj.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\tammpnj.exe" 1148 "C:\Windows\SysWOW64\tpbqprq.exe"
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        PID:4468
                                                                                                                                                                                        • C:\Windows\SysWOW64\gdekltg.exe
                                                                                                                                                                                          C:\Windows\system32\gdekltg.exe 1016 "C:\Windows\SysWOW64\tammpnj.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                          PID:3116
                                                                                                                                                                                          • C:\Windows\SysWOW64\gdekltg.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\gdekltg.exe" 1016 "C:\Windows\SysWOW64\tammpnj.exe"
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            PID:908
                                                                                                                                                                                            • C:\Windows\SysWOW64\rccygty.exe
                                                                                                                                                                                              C:\Windows\system32\rccygty.exe 1040 "C:\Windows\SysWOW64\gdekltg.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                              PID:3968
                                                                                                                                                                                              • C:\Windows\SysWOW64\rccygty.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\rccygty.exe" 1040 "C:\Windows\SysWOW64\gdekltg.exe"
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:4540
                                                                                                                                                                                                • C:\Windows\SysWOW64\ydbmmxw.exe
                                                                                                                                                                                                  C:\Windows\system32\ydbmmxw.exe 1148 "C:\Windows\SysWOW64\rccygty.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydbmmxw.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\ydbmmxw.exe" 1148 "C:\Windows\SysWOW64\rccygty.exe"
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                      • C:\Windows\SysWOW64\gljvjoq.exe
                                                                                                                                                                                                        C:\Windows\system32\gljvjoq.exe 1040 "C:\Windows\SysWOW64\ydbmmxw.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        PID:5008
                                                                                                                                                                                                        • C:\Windows\SysWOW64\gljvjoq.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\gljvjoq.exe" 1040 "C:\Windows\SysWOW64\ydbmmxw.exe"
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          PID:2624
                                                                                                                                                                                                          • C:\Windows\SysWOW64\gqfzdbm.exe
                                                                                                                                                                                                            C:\Windows\system32\gqfzdbm.exe 1040 "C:\Windows\SysWOW64\gljvjoq.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                            PID:1372
                                                                                                                                                                                                            • C:\Windows\SysWOW64\gqfzdbm.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\gqfzdbm.exe" 1040 "C:\Windows\SysWOW64\gljvjoq.exe"
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              PID:4092
                                                                                                                                                                                                              • C:\Windows\SysWOW64\lhockji.exe
                                                                                                                                                                                                                C:\Windows\system32\lhockji.exe 1148 "C:\Windows\SysWOW64\gqfzdbm.exe"
                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                PID:2820
                                                                                                                                                                                                                • C:\Windows\SysWOW64\lhockji.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\lhockji.exe" 1148 "C:\Windows\SysWOW64\gqfzdbm.exe"
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  PID:4820
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\qxfgjze.exe
                                                                                                                                                                                                                    C:\Windows\system32\qxfgjze.exe 1032 "C:\Windows\SysWOW64\lhockji.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                    PID:3740
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\qxfgjze.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\qxfgjze.exe" 1032 "C:\Windows\SysWOW64\lhockji.exe"
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      PID:432
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vshwsly.exe
                                                                                                                                                                                                                        C:\Windows\system32\vshwsly.exe 1144 "C:\Windows\SysWOW64\qxfgjze.exe"
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vshwsly.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\vshwsly.exe" 1144 "C:\Windows\SysWOW64\qxfgjze.exe"
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                            PID:1624
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ynwpqny.exe
                                                                                                                                                                                                                              C:\Windows\system32\ynwpqny.exe 1032 "C:\Windows\SysWOW64\vshwsly.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                              PID:1684
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ynwpqny.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\ynwpqny.exe" 1032 "C:\Windows\SysWOW64\vshwsly.exe"
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\veftxvu.exe
                                                                                                                                                                                                                                    C:\Windows\system32\veftxvu.exe 1032 "C:\Windows\SysWOW64\ynwpqny.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\veftxvu.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\veftxvu.exe" 1032 "C:\Windows\SysWOW64\ynwpqny.exe"
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                      PID:4772
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\azirzho.exe
                                                                                                                                                                                                                                        C:\Windows\system32\azirzho.exe 1032 "C:\Windows\SysWOW64\veftxvu.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:712
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\azirzho.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\azirzho.exe" 1032 "C:\Windows\SysWOW64\veftxvu.exe"
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\fpqvgwk.exe
                                                                                                                                                                                                                                            C:\Windows\system32\fpqvgwk.exe 1156 "C:\Windows\SysWOW64\azirzho.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\fpqvgwk.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\fpqvgwk.exe" 1156 "C:\Windows\SysWOW64\azirzho.exe"
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              PID:1956
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\njjqfkl.exe
                                                                                                                                                                                                                                                C:\Windows\system32\njjqfkl.exe 1036 "C:\Windows\SysWOW64\fpqvgwk.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\njjqfkl.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\njjqfkl.exe" 1036 "C:\Windows\SysWOW64\fpqvgwk.exe"
                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                      PID:3092
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\yjawbkd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\yjawbkd.exe 1036 "C:\Windows\SysWOW64\njjqfkl.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        PID:556
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\yjawbkd.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\yjawbkd.exe" 1036 "C:\Windows\SysWOW64\njjqfkl.exe"
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\vzriaaz.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\vzriaaz.exe 1156 "C:\Windows\SysWOW64\yjawbkd.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                            PID:3768
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vzriaaz.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\vzriaaz.exe" 1156 "C:\Windows\SysWOW64\yjawbkd.exe"
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\aulyjmu.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\aulyjmu.exe 1032 "C:\Windows\SysWOW64\vzriaaz.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\aulyjmu.exe
                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\aulyjmu.exe" 1032 "C:\Windows\SysWOW64\vzriaaz.exe"
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ctlwkla.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\ctlwkla.exe 1128 "C:\Windows\SysWOW64\aulyjmu.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ctlwkla.exe
                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\ctlwkla.exe" 1128 "C:\Windows\SysWOW64\aulyjmu.exe"
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hkuiraw.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\hkuiraw.exe 1032 "C:\Windows\SysWOW64\ctlwkla.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hkuiraw.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\hkuiraw.exe" 1032 "C:\Windows\SysWOW64\ctlwkla.exe"
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                            PID:2676
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\poqelnj.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\poqelnj.exe 1156 "C:\Windows\SysWOW64\hkuiraw.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                              PID:2820
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\poqelnj.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\poqelnj.exe" 1156 "C:\Windows\SysWOW64\hkuiraw.exe"
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\nfhhsvf.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\nfhhsvf.exe 1148 "C:\Windows\SysWOW64\poqelnj.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                    PID:1816
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\nfhhsvf.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\nfhhsvf.exe" 1148 "C:\Windows\SysWOW64\poqelnj.exe"
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                      PID:3172
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rzbythi.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\rzbythi.exe 1028 "C:\Windows\SysWOW64\nfhhsvf.exe"
                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                        PID:1260
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rzbythi.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\rzbythi.exe" 1028 "C:\Windows\SysWOW64\nfhhsvf.exe"
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                            PID:4956
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\zluttcb.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\zluttcb.exe 1092 "C:\Windows\SysWOW64\rzbythi.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\zluttcb.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\zluttcb.exe" 1092 "C:\Windows\SysWOW64\rzbythi.exe"
                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                    PID:4940
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\kwwurha.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\kwwurha.exe 1148 "C:\Windows\SysWOW64\zluttcb.exe"
                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                        PID:8
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\kwwurha.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\kwwurha.exe" 1148 "C:\Windows\SysWOW64\zluttcb.exe"
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                          PID:3316
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\pnfyypw.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\pnfyypw.exe 1032 "C:\Windows\SysWOW64\kwwurha.exe"
                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                              PID:1628
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\pnfyypw.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\pnfyypw.exe" 1032 "C:\Windows\SysWOW64\kwwurha.exe"
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mewbxfs.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\mewbxfs.exe 1040 "C:\Windows\SysWOW64\pnfyypw.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mewbxfs.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\mewbxfs.exe" 1040 "C:\Windows\SysWOW64\pnfyypw.exe"
                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        PID:3580
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\uisfrrf.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\uisfrrf.exe 1040 "C:\Windows\SysWOW64\mewbxfs.exe"
                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\uisfrrf.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\uisfrrf.exe" 1040 "C:\Windows\SysWOW64\mewbxfs.exe"
                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                PID:2900
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\zdmvbei.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\zdmvbei.exe 1160 "C:\Windows\SysWOW64\uisfrrf.exe"
                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                    PID:4124
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\zdmvbei.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\zdmvbei.exe" 1160 "C:\Windows\SysWOW64\uisfrrf.exe"
                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\eudzate.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\eudzate.exe 1040 "C:\Windows\SysWOW64\zdmvbei.exe"
                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\eudzate.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\eudzate.exe" 1040 "C:\Windows\SysWOW64\zdmvbei.exe"
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                            PID:3420
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mclixky.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\mclixky.exe 1040 "C:\Windows\SysWOW64\eudzate.exe"
                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\mclixky.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\mclixky.exe" 1040 "C:\Windows\SysWOW64\eudzate.exe"
                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\jwfygwt.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\jwfygwt.exe 1040 "C:\Windows\SysWOW64\mclixky.exe"
                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2012
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\jwfygwt.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\jwfygwt.exe" 1040 "C:\Windows\SysWOW64\mclixky.exe"
                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1808
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\refhdon.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\refhdon.exe 1040 "C:\Windows\SysWOW64\jwfygwt.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1096
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\refhdon.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\refhdon.exe" 1040 "C:\Windows\SysWOW64\jwfygwt.exe"
                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1556
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\zyxddjn.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\zyxddjn.exe 1040 "C:\Windows\SysWOW64\refhdon.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3812
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3988,i,7545522914305657361,9950105517201397946,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
                                                          1⤵
                                                            PID:540

                                                          Network

                                                          MITRE ATT&CK Matrix

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Windows\SysWOW64\xnvjvko.exe

                                                            Filesize

                                                            313KB

                                                            MD5

                                                            2f7f5560775949053f1e60fc602d52fc

                                                            SHA1

                                                            0079a814e1806cddf9a94f3cb66f8f6040dd0deb

                                                            SHA256

                                                            c50bc0ecfb7b78a952b0225bc3c616dacd83eb4626cef8aec8be08a3e1596171

                                                            SHA512

                                                            f19765d7e49e782bd43e44293d3ffcabc67f6dd4d069de3fdae78f04524ee5b20bf4aea1f428050db6eb0a4fc78cc24c1ab79fc71d2247286fcfb15522cde009

                                                          • memory/1132-16-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1132-22-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1172-122-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1484-82-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1644-62-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1724-112-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1768-3-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1768-0-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1768-10-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/1768-2-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/2420-132-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/2988-92-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/3200-52-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/3324-152-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/3352-102-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/3384-42-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/4384-72-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/4604-142-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB

                                                          • memory/4872-32-0x0000000000400000-0x0000000000476000-memory.dmp

                                                            Filesize

                                                            472KB