Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 11:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe
Resource
win7-20240704-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe
-
Size
48KB
-
MD5
5bb68cbc88a927f2399e0b5404fe9368
-
SHA1
2e321e5a77658492932a3fd58cb8ea3a38edda89
-
SHA256
b6c7ae9985097367e00bbf60d1436a7d52afafd26a931ef9523643fc533ce24f
-
SHA512
ca76e4c550e4a9ef6ce88d742d84f72c333b8ee361caece7f73de6754fadd2bba37bbd2d0ea609f6356b2a1ee86bab1647b5226ba48523f81c39fa76bfe4c712
-
SSDEEP
768:5UzZqNeSIAaE6EtzwuZDfDc8iTEc38Z0D6Z878OHQxVE0kCSiqyLeCDyBrIBN4sI:qVqMSgow0Lcyc1Dc8NCZSirx8rS4H
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2468 capmhzqd.exe 2332 dllpwkdg.exe 2448 advcgzjc.exe 2152 atlndkwf.exe 2712 rdlmhhpe.exe 2676 libcckxm.exe 2604 secnrukp.exe 372 cliduxtp.exe 1224 cmdojhos.exe 1984 xmleecxa.exe 1072 netrwade.exe 1032 netgwptm.exe 2860 libtgfyh.exe 2744 drvrjihq.exe 2176 cliuysct.exe 444 umcstvlb.exe 2056 xmlvifyw.exe 668 netiavea.exe 1832 rdlspfzd.exe 1912 regvfpmg.exe 1616 sysiwfsk.exe 1016 cmdgribk.exe 1708 umcjgswn.exe 2164 advhjvfv.exe 2224 atlkzfsy.exe 2432 regxivyc.exe 1684 drvyaibf.exe 2352 advclvlr.exe 2640 advqlljy.exe 2276 comdvipc.exe 2828 igfuxdxk.exe 2876 xmlfnnkn.exe 2696 atlviqtn.exe 2864 netgxboq.exe 2632 regwsdxz.exe 2676 sechpokc.exe 664 cmduzdqy.exe 524 igfwoolb.exe 1952 winvrquj.exe 780 capxgbhm.exe 1272 rdlwbeqm.exe 1940 secjttvq.exe 2772 sysliert.exe 1916 comwxoew.exe 2444 igfnsrme.exe 2796 capakgsa.exe 2260 dllkzrnd.exe 2168 umcnpbbg.exe 1716 advlrejp.exe 1808 comybups.exe 2200 climcrfs.exe 752 schzthtw.exe 1968 capqojce.exe 1616 netaduph.exe 1696 regrgoxh.exe 1708 libbwztk.exe 2284 drvsqcbs.exe 1804 clidgmow.exe 1548 umctjpxw.exe 1232 atlgseda.exe 1684 atlutcbh.exe 3056 reghkrhl.exe 2276 schgfupl.exe 2828 drviueco.exe -
Loads dropped DLL 64 IoCs
pid Process 1512 5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe 1512 5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe 2468 capmhzqd.exe 2468 capmhzqd.exe 2332 dllpwkdg.exe 2332 dllpwkdg.exe 2448 advcgzjc.exe 2448 advcgzjc.exe 2152 atlndkwf.exe 2152 atlndkwf.exe 2712 rdlmhhpe.exe 2712 rdlmhhpe.exe 2676 libcckxm.exe 2676 libcckxm.exe 2604 secnrukp.exe 2604 secnrukp.exe 372 cliduxtp.exe 372 cliduxtp.exe 1224 cmdojhos.exe 1224 cmdojhos.exe 1984 xmleecxa.exe 1984 xmleecxa.exe 1072 netrwade.exe 1072 netrwade.exe 1032 netgwptm.exe 1032 netgwptm.exe 2860 libtgfyh.exe 2860 libtgfyh.exe 2744 drvrjihq.exe 2744 drvrjihq.exe 2176 cliuysct.exe 2176 cliuysct.exe 444 umcstvlb.exe 444 umcstvlb.exe 2056 xmlvifyw.exe 2056 xmlvifyw.exe 668 netiavea.exe 668 netiavea.exe 1832 rdlspfzd.exe 1832 rdlspfzd.exe 1912 regvfpmg.exe 1912 regvfpmg.exe 1616 sysiwfsk.exe 1616 sysiwfsk.exe 1016 cmdgribk.exe 1016 cmdgribk.exe 1708 umcjgswn.exe 1708 umcjgswn.exe 2164 advhjvfv.exe 2164 advhjvfv.exe 2224 atlkzfsy.exe 2224 atlkzfsy.exe 2212 libigftx.exe 2212 libigftx.exe 1684 drvyaibf.exe 1684 drvyaibf.exe 2352 advclvlr.exe 2352 advclvlr.exe 2640 advqlljy.exe 2640 advqlljy.exe 2276 comdvipc.exe 2276 comdvipc.exe 2828 igfuxdxk.exe 2828 igfuxdxk.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\xmliwill.exe cmdkbfcd.exe File opened for modification C:\Windows\SysWOW64\reggxilx.exe comdiyqu.exe File created C:\Windows\SysWOW64\sysmjcci.exe advwgati.exe File opened for modification C:\Windows\SysWOW64\cliaaklu.exe secbfhcm.exe File created C:\Windows\SysWOW64\advytttd.exe convdiga.exe File opened for modification C:\Windows\SysWOW64\cmdjnvop.exe cmdvnyyi.exe File opened for modification C:\Windows\SysWOW64\dllkihiv.exe drvtnean.exe File opened for modification C:\Windows\SysWOW64\coneuwsc.exe atlrcgmy.exe File opened for modification C:\Windows\SysWOW64\regsjhum.exe atlfrroi.exe File opened for modification C:\Windows\SysWOW64\cmdysina.exe sysayfes.exe File opened for modification C:\Windows\SysWOW64\rdlblscc.exe netrwipz.exe File opened for modification C:\Windows\SysWOW64\capjcdqr.exe winhnsco.exe File opened for modification C:\Windows\SysWOW64\clicczty.exe libplknu.exe File created C:\Windows\SysWOW64\schkrqsw.exe igfhugxt.exe File opened for modification C:\Windows\SysWOW64\sysljfcr.exe conyzpwn.exe File opened for modification C:\Windows\SysWOW64\umccpyzp.exe cmdraomm.exe File created C:\Windows\SysWOW64\comuerux.exe atlvbplp.exe File opened for modification C:\Windows\SysWOW64\winkccop.exe igftzafh.exe File opened for modification C:\Windows\SysWOW64\sysakqoq.exe advcpnyi.exe File opened for modification C:\Windows\SysWOW64\secgqkgq.exe libebatn.exe File created C:\Windows\SysWOW64\cmdcpugp.exe cliaaklu.exe File opened for modification C:\Windows\SysWOW64\cliyvnfd.exe sechskwd.exe File opened for modification C:\Windows\SysWOW64\advjvcws.exe conzfsbp.exe File created C:\Windows\SysWOW64\schcerzb.exe regejpqt.exe File opened for modification C:\Windows\SysWOW64\winmywgs.exe igfndtyk.exe File created C:\Windows\SysWOW64\igfkxrui.exe comucola.exe File opened for modification C:\Windows\SysWOW64\drvbypmb.exe schrjeqy.exe File created C:\Windows\SysWOW64\sechskwd.exe comujnqz.exe File created C:\Windows\SysWOW64\umcnpqkp.exe clixunbg.exe File created C:\Windows\SysWOW64\comlotsp.exe atlvtqkp.exe File opened for modification C:\Windows\SysWOW64\dlltoapw.exe schyxlks.exe File opened for modification C:\Windows\SysWOW64\seccrnwp.exe libzucbl.exe File created C:\Windows\SysWOW64\seccsdrz.exe conlxaiy.exe File created C:\Windows\SysWOW64\cmdvnyyi.exe secidise.exe File opened for modification C:\Windows\SysWOW64\xmlojxrp.exe cmdxouig.exe File opened for modification C:\Windows\SysWOW64\cappmsqx.exe igfcudkc.exe File created C:\Windows\SysWOW64\capkdyej.exe schuiwwi.exe File created C:\Windows\SysWOW64\schukzey.exe regwhwvy.exe File created C:\Windows\SysWOW64\igfkycpq.exe comldahi.exe File created C:\Windows\SysWOW64\schxhmik.exe conzmkak.exe File opened for modification C:\Windows\SysWOW64\drvhhgqm.exe reguprci.exe File created C:\Windows\SysWOW64\sysluucf.exe conmarux.exe File created C:\Windows\SysWOW64\atlviqtn.exe xmlfnnkn.exe File opened for modification C:\Windows\SysWOW64\atlwwhmd.exe umcjnsgz.exe File opened for modification C:\Windows\SysWOW64\netweztm.exe atluhpfj.exe File opened for modification C:\Windows\SysWOW64\librqlvx.exe rdltvinp.exe File created C:\Windows\SysWOW64\caprqwca.exe schavttr.exe File opened for modification C:\Windows\SysWOW64\schcerzb.exe regejpqt.exe File opened for modification C:\Windows\SysWOW64\confyxwa.exe dllhdunr.exe File created C:\Windows\SysWOW64\clipcgci.exe secyhdti.exe File created C:\Windows\SysWOW64\advqlljy.exe advclvlr.exe File created C:\Windows\SysWOW64\dllbhtnm.exe drvkmyfe.exe File created C:\Windows\SysWOW64\winkccop.exe igftzafh.exe File opened for modification C:\Windows\SysWOW64\xmlqutgt.exe cmdarqxl.exe File created C:\Windows\SysWOW64\igfpmrdt.exe rdlzrpvl.exe File created C:\Windows\SysWOW64\umcubdge.exe dlljlttb.exe File opened for modification C:\Windows\SysWOW64\conoowxi.exe conangza.exe File created C:\Windows\SysWOW64\schmygob.exe schyfjyt.exe File created C:\Windows\SysWOW64\netfkyqj.exe winhivhb.exe File created C:\Windows\SysWOW64\drvdjbzj.exe libfhyqj.exe File created C:\Windows\SysWOW64\netamksr.exe xmlnvmmn.exe File created C:\Windows\SysWOW64\comdzact.exe sysakqoq.exe File opened for modification C:\Windows\SysWOW64\xmllqpyf.exe capyzasb.exe File created C:\Windows\SysWOW64\sysepltd.exe winfmikd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2468 1512 5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe 30 PID 1512 wrote to memory of 2468 1512 5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe 30 PID 1512 wrote to memory of 2468 1512 5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe 30 PID 1512 wrote to memory of 2468 1512 5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe 30 PID 2468 wrote to memory of 2332 2468 capmhzqd.exe 31 PID 2468 wrote to memory of 2332 2468 capmhzqd.exe 31 PID 2468 wrote to memory of 2332 2468 capmhzqd.exe 31 PID 2468 wrote to memory of 2332 2468 capmhzqd.exe 31 PID 2332 wrote to memory of 2448 2332 dllpwkdg.exe 32 PID 2332 wrote to memory of 2448 2332 dllpwkdg.exe 32 PID 2332 wrote to memory of 2448 2332 dllpwkdg.exe 32 PID 2332 wrote to memory of 2448 2332 dllpwkdg.exe 32 PID 2448 wrote to memory of 2152 2448 advcgzjc.exe 33 PID 2448 wrote to memory of 2152 2448 advcgzjc.exe 33 PID 2448 wrote to memory of 2152 2448 advcgzjc.exe 33 PID 2448 wrote to memory of 2152 2448 advcgzjc.exe 33 PID 2152 wrote to memory of 2712 2152 atlndkwf.exe 34 PID 2152 wrote to memory of 2712 2152 atlndkwf.exe 34 PID 2152 wrote to memory of 2712 2152 atlndkwf.exe 34 PID 2152 wrote to memory of 2712 2152 atlndkwf.exe 34 PID 2712 wrote to memory of 2676 2712 rdlmhhpe.exe 35 PID 2712 wrote to memory of 2676 2712 rdlmhhpe.exe 35 PID 2712 wrote to memory of 2676 2712 rdlmhhpe.exe 35 PID 2712 wrote to memory of 2676 2712 rdlmhhpe.exe 35 PID 2676 wrote to memory of 2604 2676 libcckxm.exe 36 PID 2676 wrote to memory of 2604 2676 libcckxm.exe 36 PID 2676 wrote to memory of 2604 2676 libcckxm.exe 36 PID 2676 wrote to memory of 2604 2676 libcckxm.exe 36 PID 2604 wrote to memory of 372 2604 secnrukp.exe 37 PID 2604 wrote to memory of 372 2604 secnrukp.exe 37 PID 2604 wrote to memory of 372 2604 secnrukp.exe 37 PID 2604 wrote to memory of 372 2604 secnrukp.exe 37 PID 372 wrote to memory of 1224 372 cliduxtp.exe 38 PID 372 wrote to memory of 1224 372 cliduxtp.exe 38 PID 372 wrote to memory of 1224 372 cliduxtp.exe 38 PID 372 wrote to memory of 1224 372 cliduxtp.exe 38 PID 1224 wrote to memory of 1984 1224 cmdojhos.exe 39 PID 1224 wrote to memory of 1984 1224 cmdojhos.exe 39 PID 1224 wrote to memory of 1984 1224 cmdojhos.exe 39 PID 1224 wrote to memory of 1984 1224 cmdojhos.exe 39 PID 1984 wrote to memory of 1072 1984 xmleecxa.exe 40 PID 1984 wrote to memory of 1072 1984 xmleecxa.exe 40 PID 1984 wrote to memory of 1072 1984 xmleecxa.exe 40 PID 1984 wrote to memory of 1072 1984 xmleecxa.exe 40 PID 1072 wrote to memory of 1032 1072 netrwade.exe 41 PID 1072 wrote to memory of 1032 1072 netrwade.exe 41 PID 1072 wrote to memory of 1032 1072 netrwade.exe 41 PID 1072 wrote to memory of 1032 1072 netrwade.exe 41 PID 1032 wrote to memory of 2860 1032 netgwptm.exe 42 PID 1032 wrote to memory of 2860 1032 netgwptm.exe 42 PID 1032 wrote to memory of 2860 1032 netgwptm.exe 42 PID 1032 wrote to memory of 2860 1032 netgwptm.exe 42 PID 2860 wrote to memory of 2744 2860 libtgfyh.exe 43 PID 2860 wrote to memory of 2744 2860 libtgfyh.exe 43 PID 2860 wrote to memory of 2744 2860 libtgfyh.exe 43 PID 2860 wrote to memory of 2744 2860 libtgfyh.exe 43 PID 2744 wrote to memory of 2176 2744 drvrjihq.exe 44 PID 2744 wrote to memory of 2176 2744 drvrjihq.exe 44 PID 2744 wrote to memory of 2176 2744 drvrjihq.exe 44 PID 2744 wrote to memory of 2176 2744 drvrjihq.exe 44 PID 2176 wrote to memory of 444 2176 cliuysct.exe 45 PID 2176 wrote to memory of 444 2176 cliuysct.exe 45 PID 2176 wrote to memory of 444 2176 cliuysct.exe 45 PID 2176 wrote to memory of 444 2176 cliuysct.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\capmhzqd.exeC:\Windows\system32\capmhzqd.exe 124 "C:\Users\Admin\AppData\Local\Temp\5bb68cbc88a927f2399e0b5404fe9368_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\dllpwkdg.exeC:\Windows\system32\dllpwkdg.exe 124 "C:\Windows\SysWOW64\capmhzqd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\advcgzjc.exeC:\Windows\system32\advcgzjc.exe 124 "C:\Windows\SysWOW64\dllpwkdg.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\atlndkwf.exeC:\Windows\system32\atlndkwf.exe 124 "C:\Windows\SysWOW64\advcgzjc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\rdlmhhpe.exeC:\Windows\system32\rdlmhhpe.exe 124 "C:\Windows\SysWOW64\atlndkwf.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\libcckxm.exeC:\Windows\system32\libcckxm.exe 124 "C:\Windows\SysWOW64\rdlmhhpe.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\secnrukp.exeC:\Windows\system32\secnrukp.exe 124 "C:\Windows\SysWOW64\libcckxm.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cliduxtp.exeC:\Windows\system32\cliduxtp.exe 124 "C:\Windows\SysWOW64\secnrukp.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\cmdojhos.exeC:\Windows\system32\cmdojhos.exe 124 "C:\Windows\SysWOW64\cliduxtp.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\xmleecxa.exeC:\Windows\system32\xmleecxa.exe 124 "C:\Windows\SysWOW64\cmdojhos.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\netrwade.exeC:\Windows\system32\netrwade.exe 124 "C:\Windows\SysWOW64\xmleecxa.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\netgwptm.exeC:\Windows\system32\netgwptm.exe 124 "C:\Windows\SysWOW64\netrwade.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\libtgfyh.exeC:\Windows\system32\libtgfyh.exe 124 "C:\Windows\SysWOW64\netgwptm.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\drvrjihq.exeC:\Windows\system32\drvrjihq.exe 124 "C:\Windows\SysWOW64\libtgfyh.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cliuysct.exeC:\Windows\system32\cliuysct.exe 124 "C:\Windows\SysWOW64\drvrjihq.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\umcstvlb.exeC:\Windows\system32\umcstvlb.exe 124 "C:\Windows\SysWOW64\cliuysct.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:444 -
C:\Windows\SysWOW64\xmlvifyw.exeC:\Windows\system32\xmlvifyw.exe 124 "C:\Windows\SysWOW64\umcstvlb.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Windows\SysWOW64\netiavea.exeC:\Windows\system32\netiavea.exe 124 "C:\Windows\SysWOW64\xmlvifyw.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Windows\SysWOW64\rdlspfzd.exeC:\Windows\system32\rdlspfzd.exe 124 "C:\Windows\SysWOW64\netiavea.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Windows\SysWOW64\regvfpmg.exeC:\Windows\system32\regvfpmg.exe 124 "C:\Windows\SysWOW64\rdlspfzd.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Windows\SysWOW64\sysiwfsk.exeC:\Windows\system32\sysiwfsk.exe 124 "C:\Windows\SysWOW64\regvfpmg.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Windows\SysWOW64\cmdgribk.exeC:\Windows\system32\cmdgribk.exe 124 "C:\Windows\SysWOW64\sysiwfsk.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Windows\SysWOW64\umcjgswn.exeC:\Windows\system32\umcjgswn.exe 124 "C:\Windows\SysWOW64\cmdgribk.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Windows\SysWOW64\advhjvfv.exeC:\Windows\system32\advhjvfv.exe 124 "C:\Windows\SysWOW64\umcjgswn.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Windows\SysWOW64\atlkzfsy.exeC:\Windows\system32\atlkzfsy.exe 124 "C:\Windows\SysWOW64\advhjvfv.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Windows\SysWOW64\regxivyc.exeC:\Windows\system32\regxivyc.exe 124 "C:\Windows\SysWOW64\atlkzfsy.exe"27⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\libigftx.exeC:\Windows\system32\libigftx.exe 124 "C:\Windows\SysWOW64\regxivyc.exe"28⤵
- Loads dropped DLL
PID:2212 -
C:\Windows\SysWOW64\drvyaibf.exeC:\Windows\system32\drvyaibf.exe 124 "C:\Windows\SysWOW64\libigftx.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\advclvlr.exeC:\Windows\system32\advclvlr.exe 124 "C:\Windows\SysWOW64\drvyaibf.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\advqlljy.exeC:\Windows\system32\advqlljy.exe 124 "C:\Windows\SysWOW64\advclvlr.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Windows\SysWOW64\comdvipc.exeC:\Windows\system32\comdvipc.exe 124 "C:\Windows\SysWOW64\advqlljy.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Windows\SysWOW64\igfuxdxk.exeC:\Windows\system32\igfuxdxk.exe 124 "C:\Windows\SysWOW64\comdvipc.exe"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Windows\SysWOW64\xmlfnnkn.exeC:\Windows\system32\xmlfnnkn.exe 124 "C:\Windows\SysWOW64\igfuxdxk.exe"34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\atlviqtn.exeC:\Windows\system32\atlviqtn.exe 124 "C:\Windows\SysWOW64\xmlfnnkn.exe"35⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\netgxboq.exeC:\Windows\system32\netgxboq.exe 124 "C:\Windows\SysWOW64\atlviqtn.exe"36⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\SysWOW64\regwsdxz.exeC:\Windows\system32\regwsdxz.exe 124 "C:\Windows\SysWOW64\netgxboq.exe"37⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\sechpokc.exeC:\Windows\system32\sechpokc.exe 124 "C:\Windows\SysWOW64\regwsdxz.exe"38⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\cmduzdqy.exeC:\Windows\system32\cmduzdqy.exe 124 "C:\Windows\SysWOW64\sechpokc.exe"39⤵
- Executes dropped EXE
PID:664 -
C:\Windows\SysWOW64\igfwoolb.exeC:\Windows\system32\igfwoolb.exe 124 "C:\Windows\SysWOW64\cmduzdqy.exe"40⤵
- Executes dropped EXE
PID:524 -
C:\Windows\SysWOW64\winvrquj.exeC:\Windows\system32\winvrquj.exe 124 "C:\Windows\SysWOW64\igfwoolb.exe"41⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\capxgbhm.exeC:\Windows\system32\capxgbhm.exe 124 "C:\Windows\SysWOW64\winvrquj.exe"42⤵
- Executes dropped EXE
PID:780 -
C:\Windows\SysWOW64\rdlwbeqm.exeC:\Windows\system32\rdlwbeqm.exe 124 "C:\Windows\SysWOW64\capxgbhm.exe"43⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\secjttvq.exeC:\Windows\system32\secjttvq.exe 124 "C:\Windows\SysWOW64\rdlwbeqm.exe"44⤵
- Executes dropped EXE
PID:1940 -
C:\Windows\SysWOW64\sysliert.exeC:\Windows\system32\sysliert.exe 124 "C:\Windows\SysWOW64\secjttvq.exe"45⤵
- Executes dropped EXE
PID:2772 -
C:\Windows\SysWOW64\comwxoew.exeC:\Windows\system32\comwxoew.exe 124 "C:\Windows\SysWOW64\sysliert.exe"46⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\igfnsrme.exeC:\Windows\system32\igfnsrme.exe 124 "C:\Windows\SysWOW64\comwxoew.exe"47⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\capakgsa.exeC:\Windows\system32\capakgsa.exe 124 "C:\Windows\SysWOW64\igfnsrme.exe"48⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\dllkzrnd.exeC:\Windows\system32\dllkzrnd.exe 124 "C:\Windows\SysWOW64\capakgsa.exe"49⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\umcnpbbg.exeC:\Windows\system32\umcnpbbg.exe 124 "C:\Windows\SysWOW64\dllkzrnd.exe"50⤵
- Executes dropped EXE
PID:2168 -
C:\Windows\SysWOW64\advlrejp.exeC:\Windows\system32\advlrejp.exe 124 "C:\Windows\SysWOW64\umcnpbbg.exe"51⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\comybups.exeC:\Windows\system32\comybups.exe 124 "C:\Windows\SysWOW64\advlrejp.exe"52⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\climcrfs.exeC:\Windows\system32\climcrfs.exe 124 "C:\Windows\SysWOW64\comybups.exe"53⤵
- Executes dropped EXE
PID:2200 -
C:\Windows\SysWOW64\schzthtw.exeC:\Windows\system32\schzthtw.exe 124 "C:\Windows\SysWOW64\climcrfs.exe"54⤵
- Executes dropped EXE
PID:752 -
C:\Windows\SysWOW64\capqojce.exeC:\Windows\system32\capqojce.exe 124 "C:\Windows\SysWOW64\schzthtw.exe"55⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\netaduph.exeC:\Windows\system32\netaduph.exe 124 "C:\Windows\SysWOW64\capqojce.exe"56⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\regrgoxh.exeC:\Windows\system32\regrgoxh.exe 124 "C:\Windows\SysWOW64\netaduph.exe"57⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\libbwztk.exeC:\Windows\system32\libbwztk.exe 124 "C:\Windows\SysWOW64\regrgoxh.exe"58⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\drvsqcbs.exeC:\Windows\system32\drvsqcbs.exe 124 "C:\Windows\SysWOW64\libbwztk.exe"59⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\clidgmow.exeC:\Windows\system32\clidgmow.exe 124 "C:\Windows\SysWOW64\drvsqcbs.exe"60⤵
- Executes dropped EXE
PID:1804 -
C:\Windows\SysWOW64\umctjpxw.exeC:\Windows\system32\umctjpxw.exe 124 "C:\Windows\SysWOW64\clidgmow.exe"61⤵
- Executes dropped EXE
PID:1548 -
C:\Windows\SysWOW64\atlgseda.exeC:\Windows\system32\atlgseda.exe 124 "C:\Windows\SysWOW64\umctjpxw.exe"62⤵
- Executes dropped EXE
PID:1232 -
C:\Windows\SysWOW64\atlutcbh.exeC:\Windows\system32\atlutcbh.exe 124 "C:\Windows\SysWOW64\atlgseda.exe"63⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\SysWOW64\reghkrhl.exeC:\Windows\system32\reghkrhl.exe 124 "C:\Windows\SysWOW64\atlutcbh.exe"64⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\schgfupl.exeC:\Windows\system32\schgfupl.exe 124 "C:\Windows\SysWOW64\reghkrhl.exe"65⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\drviueco.exeC:\Windows\system32\drviueco.exe 124 "C:\Windows\SysWOW64\schgfupl.exe"66⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\clitkpqr.exeC:\Windows\system32\clitkpqr.exe 124 "C:\Windows\SysWOW64\drviueco.exe"67⤵PID:2644
-
C:\Windows\SysWOW64\umcjnsgz.exeC:\Windows\system32\umcjnsgz.exe 124 "C:\Windows\SysWOW64\clitkpqr.exe"68⤵
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\atlwwhmd.exeC:\Windows\system32\atlwwhmd.exe 124 "C:\Windows\SysWOW64\umcjnsgz.exe"69⤵PID:2864
-
C:\Windows\SysWOW64\seckxfcd.exeC:\Windows\system32\seckxfcd.exe 124 "C:\Windows\SysWOW64\atlwwhmd.exe"70⤵PID:1084
-
C:\Windows\SysWOW64\cmdxouig.exeC:\Windows\system32\cmdxouig.exe 124 "C:\Windows\SysWOW64\seckxfcd.exe"71⤵
- Drops file in System32 directory
PID:2856 -
C:\Windows\SysWOW64\xmlojxrp.exeC:\Windows\system32\xmlojxrp.exe 124 "C:\Windows\SysWOW64\cmdxouig.exe"72⤵PID:1172
-
C:\Windows\SysWOW64\winzzhms.exeC:\Windows\system32\winzzhms.exe 124 "C:\Windows\SysWOW64\xmlojxrp.exe"73⤵PID:1608
-
C:\Windows\SysWOW64\netpbkus.exeC:\Windows\system32\netpbkus.exe 124 "C:\Windows\SysWOW64\winzzhms.exe"74⤵PID:1376
-
C:\Windows\SysWOW64\rdlarviv.exeC:\Windows\system32\rdlarviv.exe 124 "C:\Windows\SysWOW64\netpbkus.exe"75⤵PID:1680
-
C:\Windows\SysWOW64\libqmpqd.exeC:\Windows\system32\libqmpqd.exe 124 "C:\Windows\SysWOW64\rdlarviv.exe"76⤵PID:2788
-
C:\Windows\SysWOW64\secbbalg.exeC:\Windows\system32\secbbalg.exe 124 "C:\Windows\SysWOW64\libqmpqd.exe"77⤵PID:3020
-
C:\Windows\SysWOW64\clirwcuo.exeC:\Windows\system32\clirwcuo.exe 124 "C:\Windows\SysWOW64\secbbalg.exe"78⤵PID:692
-
C:\Windows\SysWOW64\xmlensak.exeC:\Windows\system32\xmlensak.exe 124 "C:\Windows\SysWOW64\clirwcuo.exe"79⤵PID:1032
-
C:\Windows\SysWOW64\xmlsopqs.exeC:\Windows\system32\xmlsopqs.exe 124 "C:\Windows\SysWOW64\xmlensak.exe"80⤵PID:1380
-
C:\Windows\SysWOW64\netfffww.exeC:\Windows\system32\netfffww.exe 124 "C:\Windows\SysWOW64\xmlsopqs.exe"81⤵PID:1076
-
C:\Windows\SysWOW64\regeaiew.exeC:\Windows\system32\regeaiew.exe 124 "C:\Windows\SysWOW64\netfffww.exe"82⤵PID:1508
-
C:\Windows\SysWOW64\cmdkbfcd.exeC:\Windows\system32\cmdkbfcd.exe 124 "C:\Windows\SysWOW64\regeaiew.exe"83⤵
- Drops file in System32 directory
PID:1988 -
C:\Windows\SysWOW64\xmliwill.exeC:\Windows\system32\xmliwill.exe 124 "C:\Windows\SysWOW64\cmdkbfcd.exe"84⤵PID:1700
-
C:\Windows\SysWOW64\rdlvnyrp.exeC:\Windows\system32\rdlvnyrp.exe 124 "C:\Windows\SysWOW64\xmliwill.exe"85⤵PID:1644
-
C:\Windows\SysWOW64\libmiazp.exeC:\Windows\system32\libmiazp.exe 124 "C:\Windows\SysWOW64\rdlvnyrp.exe"86⤵PID:2024
-
C:\Windows\SysWOW64\secwxlns.exeC:\Windows\system32\secwxlns.exe 124 "C:\Windows\SysWOW64\libmiazp.exe"87⤵PID:680
-
C:\Windows\SysWOW64\clinanvb.exeC:\Windows\system32\clinanvb.exe 124 "C:\Windows\SysWOW64\secwxlns.exe"88⤵PID:1740
-
C:\Windows\SysWOW64\cmdyqyqe.exeC:\Windows\system32\cmdyqyqe.exe 124 "C:\Windows\SysWOW64\clinanvb.exe"89⤵PID:1800
-
C:\Windows\SysWOW64\xmlokaze.exeC:\Windows\system32\xmlokaze.exe 124 "C:\Windows\SysWOW64\cmdyqyqe.exe"90⤵PID:2428
-
C:\Windows\SysWOW64\atlnfdim.exeC:\Windows\system32\atlnfdim.exe 124 "C:\Windows\SysWOW64\xmlokaze.exe"91⤵PID:2012
-
C:\Windows\SysWOW64\comdiyqu.exeC:\Windows\system32\comdiyqu.exe 124 "C:\Windows\SysWOW64\atlnfdim.exe"92⤵
- Drops file in System32 directory
PID:2052 -
C:\Windows\SysWOW64\reggxilx.exeC:\Windows\system32\reggxilx.exe 124 "C:\Windows\SysWOW64\comdiyqu.exe"93⤵PID:1600
-
C:\Windows\SysWOW64\schesluy.exeC:\Windows\system32\schesluy.exe 124 "C:\Windows\SysWOW64\reggxilx.exe"94⤵PID:2068
-
C:\Windows\SysWOW64\winhivhb.exeC:\Windows\system32\winhivhb.exe 124 "C:\Windows\SysWOW64\schesluy.exe"95⤵
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\netfkyqj.exeC:\Windows\system32\netfkyqj.exe 124 "C:\Windows\SysWOW64\winhivhb.exe"96⤵PID:2944
-
C:\Windows\SysWOW64\rdliailm.exeC:\Windows\system32\rdliailm.exe 124 "C:\Windows\SysWOW64\netfkyqj.exe"97⤵PID:2684
-
C:\Windows\SysWOW64\libgvlum.exeC:\Windows\system32\libgvlum.exe 124 "C:\Windows\SysWOW64\rdliailm.exe"98⤵PID:2576
-
C:\Windows\SysWOW64\clitmbzq.exeC:\Windows\system32\clitmbzq.exe 124 "C:\Windows\SysWOW64\libgvlum.exe"99⤵PID:2584
-
C:\Windows\SysWOW64\clihnypx.exeC:\Windows\system32\clihnypx.exe 124 "C:\Windows\SysWOW64\clitmbzq.exe"100⤵PID:2008
-
C:\Windows\SysWOW64\xmluwovb.exeC:\Windows\system32\xmluwovb.exe 124 "C:\Windows\SysWOW64\clihnypx.exe"101⤵PID:2368
-
C:\Windows\SysWOW64\atllzreb.exeC:\Windows\system32\atllzreb.exe 124 "C:\Windows\SysWOW64\xmluwovb.exe"102⤵PID:1056
-
C:\Windows\SysWOW64\netvpbze.exeC:\Windows\system32\netvpbze.exe 124 "C:\Windows\SysWOW64\atllzreb.exe"103⤵PID:664
-
C:\Windows\SysWOW64\regmjein.exeC:\Windows\system32\regmjein.exe 124 "C:\Windows\SysWOW64\netvpbze.exe"104⤵PID:1908
-
C:\Windows\SysWOW64\libxzovq.exeC:\Windows\system32\libxzovq.exe 124 "C:\Windows\SysWOW64\regmjein.exe"105⤵PID:844
-
C:\Windows\SysWOW64\drvncrey.exeC:\Windows\system32\drvncrey.exe 124 "C:\Windows\SysWOW64\libxzovq.exe"106⤵PID:1984
-
C:\Windows\SysWOW64\dllewtmy.exeC:\Windows\system32\dllewtmy.exe 124 "C:\Windows\SysWOW64\drvncrey.exe"107⤵PID:1348
-
C:\Windows\SysWOW64\concrovg.exeC:\Windows\system32\concrovg.exe 124 "C:\Windows\SysWOW64\dllewtmy.exe"108⤵PID:2752
-
C:\Windows\SysWOW64\libfhyqj.exeC:\Windows\system32\libfhyqj.exe 124 "C:\Windows\SysWOW64\concrovg.exe"109⤵
- Drops file in System32 directory
PID:1812 -
C:\Windows\SysWOW64\drvdjbzj.exeC:\Windows\system32\drvdjbzj.exe 124 "C:\Windows\SysWOW64\libfhyqj.exe"110⤵PID:2624
-
C:\Windows\SysWOW64\cligzmmn.exeC:\Windows\system32\cligzmmn.exe 124 "C:\Windows\SysWOW64\drvdjbzj.exe"111⤵PID:2772
-
C:\Windows\SysWOW64\umceuouv.exeC:\Windows\system32\umceuouv.exe 124 "C:\Windows\SysWOW64\cligzmmn.exe"112⤵PID:1916
-
C:\Windows\SysWOW64\xmlhjzqy.exeC:\Windows\system32\xmlhjzqy.exe 124 "C:\Windows\SysWOW64\umceuouv.exe"113⤵PID:2144
-
C:\Windows\SysWOW64\atlfmbyg.exeC:\Windows\system32\atlfmbyg.exe 124 "C:\Windows\SysWOW64\xmlhjzqy.exe"114⤵PID:608
-
C:\Windows\SysWOW64\regsvrec.exeC:\Windows\system32\regsvrec.exe 124 "C:\Windows\SysWOW64\atlfmbyg.exe"115⤵PID:1040
-
C:\Windows\SysWOW64\regywouj.exeC:\Windows\system32\regywouj.exe 124 "C:\Windows\SysWOW64\regsvrec.exe"116⤵PID:1988
-
C:\Windows\SysWOW64\drvtnean.exeC:\Windows\system32\drvtnean.exe 124 "C:\Windows\SysWOW64\regywouj.exe"117⤵
- Drops file in System32 directory
PID:2532 -
C:\Windows\SysWOW64\dllkihiv.exeC:\Windows\system32\dllkihiv.exe 124 "C:\Windows\SysWOW64\drvtnean.exe"118⤵PID:1992
-
C:\Windows\SysWOW64\umcuyreq.exeC:\Windows\system32\umcuyreq.exe 124 "C:\Windows\SysWOW64\dllkihiv.exe"119⤵PID:1968
-
C:\Windows\SysWOW64\advlaumz.exeC:\Windows\system32\advlaumz.exe 124 "C:\Windows\SysWOW64\umcuyreq.exe"120⤵PID:2096
-
C:\Windows\SysWOW64\atloqeac.exeC:\Windows\system32\atloqeac.exe 124 "C:\Windows\SysWOW64\advlaumz.exe"121⤵PID:1696
-
C:\Windows\SysWOW64\climlhik.exeC:\Windows\system32\climlhik.exe 124 "C:\Windows\SysWOW64\atloqeac.exe"122⤵PID:2004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-