Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 01:17
Behavioral task
behavioral1
Sample
5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe
-
Size
30KB
-
MD5
5e79461338044d5c3300e09629256dd2
-
SHA1
c86397314c08bac73692dbd54243c8dfef64a1a1
-
SHA256
b083628c49c9b22b7fb150092edaac83e098aa1b01a3b8ef844f2f16598d6a73
-
SHA512
29b129329993634fee5cbe0c35519470656be41b99d20ad452a3f67d677848bde6d877a55e79f4305d495ad0b4b490fe621821392f8e037bc2113072ec7faf0f
-
SSDEEP
768:Mu7sgdL97gFKN7D/WunV0ls0wApalo3zecW4i:TDdB7gFK7S4jOaGScWH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 960 rBot.exe 1860 alg32.exe 116 alg32.exe 2708 alg32.exe 1368 alg32.exe 632 alg32.exe 1596 alg32.exe 4492 alg32.exe 4760 alg32.exe 1624 alg32.exe 2248 alg32.exe 3664 alg32.exe 4380 alg32.exe 5048 alg32.exe 4744 alg32.exe 3240 alg32.exe 3532 alg32.exe 2196 alg32.exe 5012 alg32.exe 1740 alg32.exe 1940 alg32.exe 3184 alg32.exe 4136 alg32.exe 4088 alg32.exe 3248 alg32.exe 5076 alg32.exe 1752 alg32.exe 3556 alg32.exe 4600 alg32.exe 3588 alg32.exe 1920 alg32.exe 3156 alg32.exe 3444 alg32.exe 2348 alg32.exe 4784 alg32.exe 4212 alg32.exe 1300 alg32.exe 1412 alg32.exe 1780 alg32.exe 2560 alg32.exe 2304 alg32.exe 4384 alg32.exe 4720 alg32.exe 3404 alg32.exe 732 alg32.exe 624 alg32.exe 3188 alg32.exe 1492 alg32.exe 3600 alg32.exe 4388 alg32.exe 4444 alg32.exe 5104 alg32.exe 2036 alg32.exe 4164 alg32.exe 660 alg32.exe 4848 alg32.exe 3356 alg32.exe 1552 alg32.exe 612 alg32.exe 2832 alg32.exe 4572 alg32.exe 1764 alg32.exe 4984 alg32.exe 4968 alg32.exe -
resource yara_rule behavioral2/memory/1240-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1240-12-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe Process not Found File created C:\Windows\SysWOW64\alg32.exe alg32.exe File created C:\Windows\SysWOW64\alg32.exe alg32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1240 5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 960 1240 5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe 87 PID 1240 wrote to memory of 960 1240 5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe 87 PID 1240 wrote to memory of 960 1240 5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe 87 PID 960 wrote to memory of 1860 960 rBot.exe 88 PID 960 wrote to memory of 1860 960 rBot.exe 88 PID 960 wrote to memory of 1860 960 rBot.exe 88 PID 1860 wrote to memory of 116 1860 alg32.exe 89 PID 1860 wrote to memory of 116 1860 alg32.exe 89 PID 1860 wrote to memory of 116 1860 alg32.exe 89 PID 116 wrote to memory of 2708 116 alg32.exe 90 PID 116 wrote to memory of 2708 116 alg32.exe 90 PID 116 wrote to memory of 2708 116 alg32.exe 90 PID 2708 wrote to memory of 1368 2708 alg32.exe 91 PID 2708 wrote to memory of 1368 2708 alg32.exe 91 PID 2708 wrote to memory of 1368 2708 alg32.exe 91 PID 1368 wrote to memory of 632 1368 alg32.exe 92 PID 1368 wrote to memory of 632 1368 alg32.exe 92 PID 1368 wrote to memory of 632 1368 alg32.exe 92 PID 632 wrote to memory of 1596 632 alg32.exe 93 PID 632 wrote to memory of 1596 632 alg32.exe 93 PID 632 wrote to memory of 1596 632 alg32.exe 93 PID 1596 wrote to memory of 4492 1596 alg32.exe 94 PID 1596 wrote to memory of 4492 1596 alg32.exe 94 PID 1596 wrote to memory of 4492 1596 alg32.exe 94 PID 4492 wrote to memory of 4760 4492 alg32.exe 95 PID 4492 wrote to memory of 4760 4492 alg32.exe 95 PID 4492 wrote to memory of 4760 4492 alg32.exe 95 PID 4760 wrote to memory of 1624 4760 alg32.exe 96 PID 4760 wrote to memory of 1624 4760 alg32.exe 96 PID 4760 wrote to memory of 1624 4760 alg32.exe 96 PID 1624 wrote to memory of 2248 1624 alg32.exe 97 PID 1624 wrote to memory of 2248 1624 alg32.exe 97 PID 1624 wrote to memory of 2248 1624 alg32.exe 97 PID 2248 wrote to memory of 3664 2248 alg32.exe 98 PID 2248 wrote to memory of 3664 2248 alg32.exe 98 PID 2248 wrote to memory of 3664 2248 alg32.exe 98 PID 3664 wrote to memory of 4380 3664 alg32.exe 99 PID 3664 wrote to memory of 4380 3664 alg32.exe 99 PID 3664 wrote to memory of 4380 3664 alg32.exe 99 PID 4380 wrote to memory of 5048 4380 alg32.exe 100 PID 4380 wrote to memory of 5048 4380 alg32.exe 100 PID 4380 wrote to memory of 5048 4380 alg32.exe 100 PID 5048 wrote to memory of 4744 5048 alg32.exe 101 PID 5048 wrote to memory of 4744 5048 alg32.exe 101 PID 5048 wrote to memory of 4744 5048 alg32.exe 101 PID 4744 wrote to memory of 3240 4744 alg32.exe 102 PID 4744 wrote to memory of 3240 4744 alg32.exe 102 PID 4744 wrote to memory of 3240 4744 alg32.exe 102 PID 3240 wrote to memory of 3532 3240 alg32.exe 103 PID 3240 wrote to memory of 3532 3240 alg32.exe 103 PID 3240 wrote to memory of 3532 3240 alg32.exe 103 PID 3532 wrote to memory of 2196 3532 alg32.exe 104 PID 3532 wrote to memory of 2196 3532 alg32.exe 104 PID 3532 wrote to memory of 2196 3532 alg32.exe 104 PID 2196 wrote to memory of 5012 2196 alg32.exe 105 PID 2196 wrote to memory of 5012 2196 alg32.exe 105 PID 2196 wrote to memory of 5012 2196 alg32.exe 105 PID 5012 wrote to memory of 1740 5012 alg32.exe 106 PID 5012 wrote to memory of 1740 5012 alg32.exe 106 PID 5012 wrote to memory of 1740 5012 alg32.exe 106 PID 1740 wrote to memory of 1940 1740 alg32.exe 107 PID 1740 wrote to memory of 1940 1740 alg32.exe 107 PID 1740 wrote to memory of 1940 1740 alg32.exe 107 PID 1940 wrote to memory of 3184 1940 alg32.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5e79461338044d5c3300e09629256dd2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\rBot.exe"C:\Users\Admin\AppData\Local\Temp\rBot.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"23⤵
- Executes dropped EXE
PID:3184 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"24⤵
- Executes dropped EXE
PID:4136 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"25⤵
- Executes dropped EXE
PID:4088 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"26⤵
- Executes dropped EXE
PID:3248 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"27⤵
- Executes dropped EXE
PID:5076 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"28⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"29⤵
- Executes dropped EXE
PID:3556 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"30⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"31⤵
- Executes dropped EXE
PID:3588 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"32⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"33⤵
- Executes dropped EXE
PID:3156 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"34⤵
- Executes dropped EXE
PID:3444 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"35⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"36⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"37⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"38⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"39⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"40⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"41⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"42⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"43⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"44⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"45⤵
- Executes dropped EXE
PID:3404 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"46⤵
- Executes dropped EXE
PID:732 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"47⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"48⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"49⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"50⤵
- Executes dropped EXE
PID:3600 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"51⤵
- Executes dropped EXE
PID:4388 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"52⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"53⤵
- Executes dropped EXE
PID:5104 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"54⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"55⤵
- Executes dropped EXE
PID:4164 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"56⤵
- Executes dropped EXE
PID:660 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"57⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"58⤵
- Executes dropped EXE
PID:3356 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"59⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"60⤵
- Executes dropped EXE
PID:612 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"61⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"62⤵
- Executes dropped EXE
PID:4572 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"63⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"64⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"65⤵
- Executes dropped EXE
PID:4968 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"66⤵PID:224
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"67⤵PID:4336
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"68⤵PID:1400
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"69⤵PID:412
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"70⤵PID:4316
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"71⤵PID:4476
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"72⤵PID:4348
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"73⤵PID:1064
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"74⤵PID:2704
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"75⤵PID:820
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"76⤵PID:1924
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"77⤵PID:4756
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"78⤵PID:1860
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"79⤵PID:4924
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"80⤵PID:1796
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"81⤵PID:1368
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"82⤵PID:1308
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"83⤵PID:632
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"84⤵PID:1604
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"85⤵PID:2780
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"86⤵PID:4760
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"87⤵PID:1336
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"88⤵PID:848
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"89⤵PID:1864
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"90⤵PID:3664
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"91⤵PID:2280
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"92⤵PID:3384
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"93⤵PID:828
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"94⤵PID:3532
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"95⤵PID:4556
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"96⤵PID:5012
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"97⤵PID:4940
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"98⤵PID:1152
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"99⤵PID:2480
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"100⤵PID:4824
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"101⤵PID:1428
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"102⤵PID:1404
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"103⤵PID:1888
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"104⤵PID:4056
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"105⤵PID:5076
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"106⤵PID:1548
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"107⤵PID:3360
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"108⤵PID:3556
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"109⤵PID:3748
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"110⤵PID:5016
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"111⤵
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"112⤵PID:3828
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"113⤵PID:3156
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"114⤵PID:3444
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"115⤵PID:4872
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"116⤵PID:8
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"117⤵PID:4376
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"118⤵PID:1580
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"119⤵PID:1300
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"120⤵PID:1208
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"121⤵PID:728
-
C:\Windows\SysWOW64\alg32.exe"C:\Windows\system32\alg32.exe"122⤵PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-