Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 03:29
Behavioral task
behavioral1
Sample
e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe
-
Size
36KB
-
MD5
e19ea90e4cd19fa1ca546e1f5e887a73
-
SHA1
ed322739b38d824ff490f292ddf28f8c2aa2fbbc
-
SHA256
d8937bf3706fa367bd5abb3af58930949fc0d1c5469a5e79b3b7b6a87d66f552
-
SHA512
93843a1c848d2c8054d91e5dab127dda9ccbef4d893c940315c5d6dd871d7258d44baa2d7a6f4176986cdff260454f220f47058c24807fe56f05dc9c16d636de
-
SSDEEP
768:HF4hwnoCHBeyPqmxij68ngZqFdK2NG28Of2x6K221Bo0R0PLMoa6:mh2vheyPK68nfFdLNWb1BvmLMoa6
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
resource yara_rule behavioral2/memory/2776-15-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3676-17-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4400-19-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4288-21-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4196-23-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3312-25-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3500-27-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4188-29-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3336-31-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1796-33-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/804-35-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/5008-37-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3652-39-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1356-41-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2464-43-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/664-45-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2968-47-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2992-49-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1080-51-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4040-53-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/860-55-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4252-57-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4220-63-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1136-66-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3472-65-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/844-69-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2392-68-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2820-62-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2364-60-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3728-59-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4916-71-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4852-74-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/112-73-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3572-122-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2800-129-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3720-128-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3924-131-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4068-133-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3008-132-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1936-130-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1724-124-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1748-119-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/632-117-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2468-134-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4940-115-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4316-135-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4728-113-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/916-111-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3904-109-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/548-107-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3544-106-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4308-136-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3620-104-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4812-102-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1484-100-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1876-98-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/988-96-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1728-95-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2616-93-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/1512-91-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/4720-89-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/2912-138-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/3492-137-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 behavioral2/memory/376-139-0x0000000000400000-0x000000000041D000-memory.dmp modiloader_stage2 -
Executes dropped EXE 64 IoCs
pid Process 3676 intenet.exe 4400 intenet.exe 4288 intenet.exe 4196 intenet.exe 3312 intenet.exe 3500 intenet.exe 4188 intenet.exe 3336 intenet.exe 1796 intenet.exe 804 intenet.exe 5008 intenet.exe 3652 intenet.exe 1356 intenet.exe 2464 intenet.exe 664 intenet.exe 2968 intenet.exe 2992 intenet.exe 1080 intenet.exe 4040 intenet.exe 860 intenet.exe 4252 intenet.exe 3728 intenet.exe 2820 intenet.exe 3472 intenet.exe 2392 intenet.exe 4916 intenet.exe 112 intenet.exe 648 intenet.exe 4440 intenet.exe 5084 intenet.exe 1540 intenet.exe 2364 intenet.exe 4220 intenet.exe 1136 intenet.exe 844 intenet.exe 1728 intenet.exe 4852 intenet.exe 756 intenet.exe 4256 intenet.exe 1296 intenet.exe 3544 intenet.exe 2192 intenet.exe 4720 intenet.exe 1512 intenet.exe 2616 intenet.exe 988 intenet.exe 1876 intenet.exe 1484 intenet.exe 4812 intenet.exe 3620 intenet.exe 548 intenet.exe 3904 intenet.exe 916 intenet.exe 4728 intenet.exe 4940 intenet.exe 632 intenet.exe 1748 intenet.exe 1936 intenet.exe 3572 intenet.exe 1724 intenet.exe 3924 intenet.exe 3008 intenet.exe 4068 intenet.exe 3720 intenet.exe -
resource yara_rule behavioral2/memory/2776-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/files/0x0009000000023450-4.dat upx behavioral2/memory/4196-8-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2776-15-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3676-17-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4400-19-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4288-21-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4196-23-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3312-25-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3500-27-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4188-29-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3336-31-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1796-33-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/804-35-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/5008-37-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3652-39-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1356-41-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2464-43-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/664-45-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2968-47-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2992-49-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1080-51-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4040-53-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/860-55-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4252-57-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4220-63-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1136-66-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3472-65-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/844-69-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2392-68-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2820-62-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2364-60-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3728-59-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4916-71-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4852-74-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/112-73-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3572-122-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2800-129-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3720-128-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3924-131-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4068-133-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3008-132-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1936-130-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1724-124-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1748-119-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/632-117-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2468-134-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4940-115-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4316-135-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4728-113-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/916-111-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3904-109-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/548-107-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3544-106-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4308-136-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3620-104-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4812-102-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1484-100-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1876-98-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/988-96-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1728-95-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2616-93-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1512-91-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4720-89-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File created C:\Windows\SysWOW64\intenet.exe intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\$$a.bat intenet.exe File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\$$a.bat intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File created C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat intenet.exe File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe Process not Found File opened for modification C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\$$a.bat Process not Found File created C:\Windows\SysWOW64\intenet.exe intenet.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intenet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 3676 2776 e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe 83 PID 2776 wrote to memory of 3676 2776 e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe 83 PID 2776 wrote to memory of 3676 2776 e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe 83 PID 3676 wrote to memory of 4400 3676 intenet.exe 84 PID 3676 wrote to memory of 4400 3676 intenet.exe 84 PID 3676 wrote to memory of 4400 3676 intenet.exe 84 PID 4400 wrote to memory of 4288 4400 intenet.exe 85 PID 4400 wrote to memory of 4288 4400 intenet.exe 85 PID 4400 wrote to memory of 4288 4400 intenet.exe 85 PID 4288 wrote to memory of 4196 4288 intenet.exe 86 PID 4288 wrote to memory of 4196 4288 intenet.exe 86 PID 4288 wrote to memory of 4196 4288 intenet.exe 86 PID 4196 wrote to memory of 3312 4196 intenet.exe 87 PID 4196 wrote to memory of 3312 4196 intenet.exe 87 PID 4196 wrote to memory of 3312 4196 intenet.exe 87 PID 3312 wrote to memory of 3500 3312 intenet.exe 88 PID 3312 wrote to memory of 3500 3312 intenet.exe 88 PID 3312 wrote to memory of 3500 3312 intenet.exe 88 PID 3500 wrote to memory of 4188 3500 intenet.exe 89 PID 3500 wrote to memory of 4188 3500 intenet.exe 89 PID 3500 wrote to memory of 4188 3500 intenet.exe 89 PID 4188 wrote to memory of 3336 4188 intenet.exe 90 PID 4188 wrote to memory of 3336 4188 intenet.exe 90 PID 4188 wrote to memory of 3336 4188 intenet.exe 90 PID 3336 wrote to memory of 1796 3336 intenet.exe 91 PID 3336 wrote to memory of 1796 3336 intenet.exe 91 PID 3336 wrote to memory of 1796 3336 intenet.exe 91 PID 1796 wrote to memory of 804 1796 intenet.exe 92 PID 1796 wrote to memory of 804 1796 intenet.exe 92 PID 1796 wrote to memory of 804 1796 intenet.exe 92 PID 804 wrote to memory of 5008 804 intenet.exe 93 PID 804 wrote to memory of 5008 804 intenet.exe 93 PID 804 wrote to memory of 5008 804 intenet.exe 93 PID 5008 wrote to memory of 3652 5008 intenet.exe 94 PID 5008 wrote to memory of 3652 5008 intenet.exe 94 PID 5008 wrote to memory of 3652 5008 intenet.exe 94 PID 3652 wrote to memory of 1356 3652 intenet.exe 95 PID 3652 wrote to memory of 1356 3652 intenet.exe 95 PID 3652 wrote to memory of 1356 3652 intenet.exe 95 PID 1356 wrote to memory of 2464 1356 intenet.exe 96 PID 1356 wrote to memory of 2464 1356 intenet.exe 96 PID 1356 wrote to memory of 2464 1356 intenet.exe 96 PID 2464 wrote to memory of 664 2464 intenet.exe 97 PID 2464 wrote to memory of 664 2464 intenet.exe 97 PID 2464 wrote to memory of 664 2464 intenet.exe 97 PID 664 wrote to memory of 2968 664 intenet.exe 98 PID 664 wrote to memory of 2968 664 intenet.exe 98 PID 664 wrote to memory of 2968 664 intenet.exe 98 PID 2968 wrote to memory of 2992 2968 intenet.exe 99 PID 2968 wrote to memory of 2992 2968 intenet.exe 99 PID 2968 wrote to memory of 2992 2968 intenet.exe 99 PID 2992 wrote to memory of 1080 2992 intenet.exe 100 PID 2992 wrote to memory of 1080 2992 intenet.exe 100 PID 2992 wrote to memory of 1080 2992 intenet.exe 100 PID 1080 wrote to memory of 4040 1080 intenet.exe 101 PID 1080 wrote to memory of 4040 1080 intenet.exe 101 PID 1080 wrote to memory of 4040 1080 intenet.exe 101 PID 4040 wrote to memory of 860 4040 intenet.exe 102 PID 4040 wrote to memory of 860 4040 intenet.exe 102 PID 4040 wrote to memory of 860 4040 intenet.exe 102 PID 860 wrote to memory of 4252 860 intenet.exe 103 PID 860 wrote to memory of 4252 860 intenet.exe 103 PID 860 wrote to memory of 4252 860 intenet.exe 103 PID 4252 wrote to memory of 3728 4252 intenet.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e19ea90e4cd19fa1ca546e1f5e887a73_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe23⤵
- Executes dropped EXE
PID:3728 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe25⤵
- Executes dropped EXE
PID:3472 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe26⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe27⤵
- Executes dropped EXE
PID:4916 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe28⤵
- Executes dropped EXE
PID:112 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe29⤵
- Executes dropped EXE
PID:648 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe30⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe31⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe32⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe33⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe34⤵
- Executes dropped EXE
PID:4220 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe35⤵
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe36⤵
- Executes dropped EXE
PID:844 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe37⤵
- Executes dropped EXE
PID:1728 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe38⤵
- Executes dropped EXE
PID:4852 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe39⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe40⤵
- Executes dropped EXE
PID:4256 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe41⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe42⤵
- Executes dropped EXE
PID:3544 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe43⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe44⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe45⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe46⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe47⤵
- Executes dropped EXE
PID:988 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe48⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe50⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe51⤵
- Executes dropped EXE
PID:3620 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe52⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe54⤵
- Executes dropped EXE
PID:916 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4728 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe56⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe57⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe58⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe59⤵
- Executes dropped EXE
PID:1936 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe60⤵
- Executes dropped EXE
PID:3572 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe61⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe62⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe63⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe64⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe65⤵
- Executes dropped EXE
PID:3720 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe66⤵PID:2800
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe67⤵PID:2468
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe68⤵PID:4316
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe69⤵PID:4308
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe70⤵PID:3492
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe71⤵PID:376
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe72⤵PID:3668
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe73⤵PID:1456
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe74⤵PID:4632
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe75⤵PID:2704
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe76⤵PID:3976
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe77⤵PID:2092
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe78⤵PID:2228
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe79⤵PID:3160
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe80⤵
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe81⤵PID:1872
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe82⤵PID:1148
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe83⤵PID:4988
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe84⤵PID:4860
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe85⤵PID:332
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe86⤵PID:3928
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe87⤵PID:4972
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe88⤵
- System Location Discovery: System Language Discovery
PID:1188 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe89⤵PID:3264
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe90⤵PID:4488
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe91⤵PID:4908
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe92⤵PID:1628
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe93⤵PID:712
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe94⤵PID:4640
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe95⤵PID:2436
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe96⤵PID:4192
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe97⤵
- Drops file in System32 directory
PID:1424 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe98⤵
- System Location Discovery: System Language Discovery
PID:2044 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe99⤵PID:1688
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe100⤵PID:4024
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe101⤵PID:968
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe102⤵PID:2772
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe103⤵PID:224
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe104⤵PID:3748
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe105⤵PID:3856
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe106⤵PID:3584
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe107⤵PID:4744
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe108⤵PID:1200
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe109⤵PID:5128
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe110⤵PID:5148
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe111⤵PID:5168
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe112⤵PID:5188
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe113⤵PID:5208
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe114⤵PID:5228
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe115⤵PID:5248
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe116⤵PID:5268
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe117⤵PID:5288
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe118⤵PID:5308
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe119⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe120⤵
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe121⤵PID:5372
-
C:\Windows\SysWOW64\intenet.exeC:\Windows\system32\intenet.exe122⤵PID:5388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-