Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/09/2024, 06:40
Behavioral task
behavioral1
Sample
e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe
-
Size
600KB
-
MD5
e435b6f60ed68fe29ad76ba055220264
-
SHA1
b9717d62e82e0f85a94672fd033e63ab876a7e61
-
SHA256
e626e340cf2cdd3e55b21b122056d3f3ef880bcffcef4abc0659ff48d3eb3f4d
-
SHA512
571ef5cc5d2c3a017ccfcbb52892b4c7946b6df2161dd3f24408bb8b8d55a9a91b6c68a1377f884cf28b71d21fe7aa637b361deda98a011cfa0e1c4f55bf237b
-
SSDEEP
12288:OtGXSmp9GRnlPQk04nQGWPv9p0Ijqfh3CfjRhNXXUtGSvCEafw:H+IkTQVnf0eq5hGS6Eyw
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000d000000012262-2.dat acprotect -
Executes dropped EXE 64 IoCs
pid Process 2964 yuadhrt.exe 2872 aidgcri.exe 2768 klbjrhy.exe 2716 mrhlhzz.exe 1232 lydtaxk.exe 760 iwkttep.exe 1308 tmlzduu.exe 2968 bjwwosg.exe 2264 dpdzekq.exe 1272 ceypvvi.exe 1704 clwmgqv.exe 2272 bexxilf.exe 1088 kwihpdv.exe 1728 sevzbte.exe 1592 xbahpum.exe 2376 enzvmou.exe 812 htnxcfv.exe 2760 mjksqtg.exe 2876 rtangrm.exe 2572 vbxicfy.exe 944 nmlkepi.exe 2888 xpjvrso.exe 1140 kubdzix.exe 2988 tiuapqk.exe 2464 yowscmh.exe 784 igmyhcb.exe 908 prkdewr.exe 1068 vstyubx.exe 1540 wrhosyd.exe 2552 keqdycj.exe 304 ldetwhx.exe 2520 wcqqgfw.exe 2196 gugwlwy.exe 2288 qtktdug.exe 2300 spnwyvn.exe 2708 crcgmyb.exe 624 kzyggnc.exe 2652 rdilpyn.exe 1776 wqttjis.exe 1936 jzxoldh.exe 1084 luargdo.exe 752 srkwyoz.exe 2020 avujphb.exe 1988 zcibbxl.exe 972 fmqesuj.exe 1652 plccctq.exe 2684 oszmkwg.exe 1716 bjupswl.exe 1172 iqqhfmv.exe 1524 vdzxkqu.exe 1644 sivxrfm.exe 1368 cakcwwg.exe 3028 zfoucdz.exe 2832 rqtmcaz.exe 892 bxfkvzh.exe 2044 mwjpfyg.exe 2928 qbdxyit.exe 2604 ddjfkmx.exe 1564 yxovkfg.exe 2672 kdfpywr.exe 2008 kvoisjb.exe 2644 xqyxyna.exe 1444 bycsutl.exe 1980 jdnxdmo.exe -
Loads dropped DLL 64 IoCs
pid Process 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 2964 yuadhrt.exe 2964 yuadhrt.exe 2964 yuadhrt.exe 2872 aidgcri.exe 2872 aidgcri.exe 2872 aidgcri.exe 2768 klbjrhy.exe 2768 klbjrhy.exe 2768 klbjrhy.exe 2716 mrhlhzz.exe 2716 mrhlhzz.exe 2716 mrhlhzz.exe 1232 lydtaxk.exe 1232 lydtaxk.exe 1232 lydtaxk.exe 760 iwkttep.exe 760 iwkttep.exe 760 iwkttep.exe 1308 tmlzduu.exe 1308 tmlzduu.exe 1308 tmlzduu.exe 2968 bjwwosg.exe 2968 bjwwosg.exe 2968 bjwwosg.exe 2264 dpdzekq.exe 2264 dpdzekq.exe 2264 dpdzekq.exe 1272 ceypvvi.exe 1272 ceypvvi.exe 1272 ceypvvi.exe 1704 clwmgqv.exe 1704 clwmgqv.exe 1704 clwmgqv.exe 2272 bexxilf.exe 2272 bexxilf.exe 2272 bexxilf.exe 1088 kwihpdv.exe 1088 kwihpdv.exe 1088 kwihpdv.exe 1728 sevzbte.exe 1728 sevzbte.exe 1728 sevzbte.exe 1592 xbahpum.exe 1592 xbahpum.exe 1592 xbahpum.exe 2376 enzvmou.exe 2376 enzvmou.exe 2376 enzvmou.exe 812 htnxcfv.exe 812 htnxcfv.exe 812 htnxcfv.exe 2760 mjksqtg.exe 2760 mjksqtg.exe 2760 mjksqtg.exe 2876 rtangrm.exe 2876 rtangrm.exe 2876 rtangrm.exe 2572 vbxicfy.exe 2572 vbxicfy.exe 2572 vbxicfy.exe 944 nmlkepi.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mztlouj.exe capovwk.exe File created C:\Windows\SysWOW64\dcrnwpc.exe toqxyhw.exe File opened for modification C:\Windows\SysWOW64\gumzgko.exe hmoghpz.exe File created C:\Windows\SysWOW64\gpkrmas.exe tcbcgwt.exe File created C:\Windows\SysWOW64\zlpbxrd.exe szivaym.exe File created C:\Windows\SysWOW64\tbmbmnl.exe goulgre.exe File opened for modification C:\Windows\SysWOW64\cwnkogx.exe yktcvwl.exe File opened for modification C:\Windows\SysWOW64\uydtfrv.exe fbdttzm.exe File created C:\Windows\SysWOW64\yxuoziv.exe isutvdq.exe File opened for modification C:\Windows\SysWOW64\pooxipg.exe cyuczha.exe File created C:\Windows\SysWOW64\ftrhkzu.exe vufkrau.exe File opened for modification C:\Windows\SysWOW64\pwfdicl.exe ftqtvzf.exe File created C:\Windows\SysWOW64\cwnkogx.exe yktcvwl.exe File opened for modification C:\Windows\SysWOW64\vdsuyta.exe olutrnw.exe File opened for modification C:\Windows\SysWOW64\yajggch.exe igntwgf.exe File opened for modification C:\Windows\SysWOW64\xwasjar.exe qomspkh.exe File created C:\Windows\SysWOW64\vpdyxay.exe ijldbjn.exe File created C:\Windows\SysWOW64\qgiptws.exe gzwsixl.exe File created C:\Windows\SysWOW64\adkijhs.exe qeykyjs.exe File opened for modification C:\Windows\SysWOW64\oazypet.exe eeyoijs.exe File created C:\Windows\SysWOW64\gqqlurm.exe ddnjzrf.exe File created C:\Windows\SysWOW64\mzcucbe.exe cwnkogx.exe File created C:\Windows\SysWOW64\vzlnxve.exe wdqxzjd.exe File created C:\Windows\SysWOW64\uydtfrv.exe fbdttzm.exe File opened for modification C:\Windows\SysWOW64\ehrsicz.exe rqwpzct.exe File created C:\Windows\SysWOW64\prkdewr.exe igmyhcb.exe File created C:\Windows\SysWOW64\hvtbgdk.exe sytttdj.exe File created C:\Windows\SysWOW64\pdaqqyz.exe ehzfjey.exe File created C:\Windows\SysWOW64\xjjlxfz.exe qbwtcqq.exe File opened for modification C:\Windows\SysWOW64\pbhiwnf.exe fcvkeoy.exe File created C:\Windows\SysWOW64\cdrumts.exe nnxmokx.exe File opened for modification C:\Windows\SysWOW64\bxfkvzh.exe rqtmcaz.exe File created C:\Windows\SysWOW64\qjjobrp.exe icnwhbf.exe File opened for modification C:\Windows\SysWOW64\vzlnxve.exe wdqxzjd.exe File opened for modification C:\Windows\SysWOW64\qbwtcqq.exe doedxmr.exe File opened for modification C:\Windows\SysWOW64\xrvgjjq.exe pkinptg.exe File created C:\Windows\SysWOW64\gpavfma.exe tjraqdp.exe File opened for modification C:\Windows\SysWOW64\bjwwosg.exe tmlzduu.exe File created C:\Windows\SysWOW64\vwolhnr.exe tbmbmnl.exe File opened for modification C:\Windows\SysWOW64\bhkgeqy.exe kpkocep.exe File created C:\Windows\SysWOW64\hlyadxb.exe adkijhs.exe File opened for modification C:\Windows\SysWOW64\manicpw.exe zksgthr.exe File created C:\Windows\SysWOW64\ufsjtpq.exe myejhag.exe File created C:\Windows\SysWOW64\wcqqgfw.exe ldetwhx.exe File created C:\Windows\SysWOW64\iklvwhj.exe yswqsrh.exe File opened for modification C:\Windows\SysWOW64\oordzcn.exe dpnggdf.exe File opened for modification C:\Windows\SysWOW64\yfjxmli.exe jjbxzlz.exe File opened for modification C:\Windows\SysWOW64\dvhqhhv.exe bzggrmu.exe File opened for modification C:\Windows\SysWOW64\ddmizor.exe vzcupvp.exe File created C:\Windows\SysWOW64\mlstgug.exe feetuff.exe File opened for modification C:\Windows\SysWOW64\kqyisjn.exe xrvgjjq.exe File created C:\Windows\SysWOW64\mqcfvfp.exe zzacfxj.exe File opened for modification C:\Windows\SysWOW64\kpkocep.exe xcsywai.exe File opened for modification C:\Windows\SysWOW64\xezctaw.exe ssncayr.exe File created C:\Windows\SysWOW64\sevzbte.exe kwihpdv.exe File opened for modification C:\Windows\SysWOW64\fvqbdqe.exe yksogwn.exe File created C:\Windows\SysWOW64\imfhvji.exe nkbkxck.exe File created C:\Windows\SysWOW64\jpeanip.exe eclsuhc.exe File opened for modification C:\Windows\SysWOW64\qmsowgf.exe ixewjjv.exe File opened for modification C:\Windows\SysWOW64\xsmgwkm.exe qoctezk.exe File opened for modification C:\Windows\SysWOW64\bcdgfvc.exe rdyjuwv.exe File created C:\Windows\SysWOW64\mxlcfze.exe cvwrkvy.exe File created C:\Windows\SysWOW64\jwpefsu.exe zpdzvcn.exe File opened for modification C:\Windows\SysWOW64\cqcnvta.exe pzhkmtd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iwjtuss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bgkinkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mjksqtg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddnjzrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language otibfkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aisyzvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igntwgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qtnxhzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mplwfad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdilpyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srkwyoz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ggcdcce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcizfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vgctbjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xkmjzps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cdrumts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fmwyyys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjhgzq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qtktdug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qjttmal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdcovhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yemxfke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bgylzgx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qgiptws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nkbkxck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nzdojfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sutemyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cpmoutk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aojmzpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lgtafam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cpvmshr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yizwipa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ryflvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ohyhepz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jktyiqc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrwkxhq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xwasjar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ejfiweo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kljiktf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ejxgixc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttkwast.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnocsq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uktixzv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meqhvzo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaamplq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language doedxmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kjdfbif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdleyrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qmctppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prkdewr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yfjxmli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjjlxfz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbdehix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksmbscz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ekwmgct.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mwjpfyg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language matferk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lksbgji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language agyufwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnxmokx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language klbjrhy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfyfviw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language whkvxhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fcvkeoy.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 2964 yuadhrt.exe 2872 aidgcri.exe 2768 klbjrhy.exe 2716 mrhlhzz.exe 1232 lydtaxk.exe 760 iwkttep.exe 1308 tmlzduu.exe 2968 bjwwosg.exe 2264 dpdzekq.exe 1272 ceypvvi.exe 1704 clwmgqv.exe 2272 bexxilf.exe 1088 kwihpdv.exe 1728 sevzbte.exe 1592 xbahpum.exe 2376 enzvmou.exe 812 htnxcfv.exe 2760 mjksqtg.exe 2876 rtangrm.exe 2572 vbxicfy.exe 944 nmlkepi.exe 2888 xpjvrso.exe 1140 kubdzix.exe 2988 tiuapqk.exe 2464 yowscmh.exe 784 igmyhcb.exe 908 prkdewr.exe 1068 vstyubx.exe 1540 wrhosyd.exe 2552 keqdycj.exe 304 ldetwhx.exe 2520 wcqqgfw.exe 2196 gugwlwy.exe 2288 qtktdug.exe 2300 spnwyvn.exe 2708 crcgmyb.exe 624 kzyggnc.exe 2652 rdilpyn.exe 1776 wqttjis.exe 1936 jzxoldh.exe 1084 luargdo.exe 752 srkwyoz.exe 2020 avujphb.exe 1988 zcibbxl.exe 972 fmqesuj.exe 1652 plccctq.exe 2684 oszmkwg.exe 1716 bjupswl.exe 1172 iqqhfmv.exe 1524 vdzxkqu.exe 1644 sivxrfm.exe 1368 cakcwwg.exe 3028 zfoucdz.exe 2832 rqtmcaz.exe 892 bxfkvzh.exe 2044 mwjpfyg.exe 2928 qbdxyit.exe 2604 ddjfkmx.exe 1564 yxovkfg.exe 2672 kdfpywr.exe 2008 kvoisjb.exe 2644 xqyxyna.exe 1444 bycsutl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2964 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 31 PID 2536 wrote to memory of 2964 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 31 PID 2536 wrote to memory of 2964 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 31 PID 2536 wrote to memory of 2964 2536 e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe 31 PID 2964 wrote to memory of 2872 2964 yuadhrt.exe 32 PID 2964 wrote to memory of 2872 2964 yuadhrt.exe 32 PID 2964 wrote to memory of 2872 2964 yuadhrt.exe 32 PID 2964 wrote to memory of 2872 2964 yuadhrt.exe 32 PID 2872 wrote to memory of 2768 2872 aidgcri.exe 33 PID 2872 wrote to memory of 2768 2872 aidgcri.exe 33 PID 2872 wrote to memory of 2768 2872 aidgcri.exe 33 PID 2872 wrote to memory of 2768 2872 aidgcri.exe 33 PID 2768 wrote to memory of 2716 2768 klbjrhy.exe 34 PID 2768 wrote to memory of 2716 2768 klbjrhy.exe 34 PID 2768 wrote to memory of 2716 2768 klbjrhy.exe 34 PID 2768 wrote to memory of 2716 2768 klbjrhy.exe 34 PID 2716 wrote to memory of 1232 2716 mrhlhzz.exe 35 PID 2716 wrote to memory of 1232 2716 mrhlhzz.exe 35 PID 2716 wrote to memory of 1232 2716 mrhlhzz.exe 35 PID 2716 wrote to memory of 1232 2716 mrhlhzz.exe 35 PID 1232 wrote to memory of 760 1232 lydtaxk.exe 36 PID 1232 wrote to memory of 760 1232 lydtaxk.exe 36 PID 1232 wrote to memory of 760 1232 lydtaxk.exe 36 PID 1232 wrote to memory of 760 1232 lydtaxk.exe 36 PID 760 wrote to memory of 1308 760 iwkttep.exe 37 PID 760 wrote to memory of 1308 760 iwkttep.exe 37 PID 760 wrote to memory of 1308 760 iwkttep.exe 37 PID 760 wrote to memory of 1308 760 iwkttep.exe 37 PID 1308 wrote to memory of 2968 1308 tmlzduu.exe 38 PID 1308 wrote to memory of 2968 1308 tmlzduu.exe 38 PID 1308 wrote to memory of 2968 1308 tmlzduu.exe 38 PID 1308 wrote to memory of 2968 1308 tmlzduu.exe 38 PID 2968 wrote to memory of 2264 2968 bjwwosg.exe 39 PID 2968 wrote to memory of 2264 2968 bjwwosg.exe 39 PID 2968 wrote to memory of 2264 2968 bjwwosg.exe 39 PID 2968 wrote to memory of 2264 2968 bjwwosg.exe 39 PID 2264 wrote to memory of 1272 2264 dpdzekq.exe 40 PID 2264 wrote to memory of 1272 2264 dpdzekq.exe 40 PID 2264 wrote to memory of 1272 2264 dpdzekq.exe 40 PID 2264 wrote to memory of 1272 2264 dpdzekq.exe 40 PID 1272 wrote to memory of 1704 1272 ceypvvi.exe 41 PID 1272 wrote to memory of 1704 1272 ceypvvi.exe 41 PID 1272 wrote to memory of 1704 1272 ceypvvi.exe 41 PID 1272 wrote to memory of 1704 1272 ceypvvi.exe 41 PID 1704 wrote to memory of 2272 1704 clwmgqv.exe 42 PID 1704 wrote to memory of 2272 1704 clwmgqv.exe 42 PID 1704 wrote to memory of 2272 1704 clwmgqv.exe 42 PID 1704 wrote to memory of 2272 1704 clwmgqv.exe 42 PID 2272 wrote to memory of 1088 2272 bexxilf.exe 43 PID 2272 wrote to memory of 1088 2272 bexxilf.exe 43 PID 2272 wrote to memory of 1088 2272 bexxilf.exe 43 PID 2272 wrote to memory of 1088 2272 bexxilf.exe 43 PID 1088 wrote to memory of 1728 1088 kwihpdv.exe 44 PID 1088 wrote to memory of 1728 1088 kwihpdv.exe 44 PID 1088 wrote to memory of 1728 1088 kwihpdv.exe 44 PID 1088 wrote to memory of 1728 1088 kwihpdv.exe 44 PID 1728 wrote to memory of 1592 1728 sevzbte.exe 45 PID 1728 wrote to memory of 1592 1728 sevzbte.exe 45 PID 1728 wrote to memory of 1592 1728 sevzbte.exe 45 PID 1728 wrote to memory of 1592 1728 sevzbte.exe 45 PID 1592 wrote to memory of 2376 1592 xbahpum.exe 46 PID 1592 wrote to memory of 2376 1592 xbahpum.exe 46 PID 1592 wrote to memory of 2376 1592 xbahpum.exe 46 PID 1592 wrote to memory of 2376 1592 xbahpum.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\yuadhrt.exeC:\Windows\system32\yuadhrt.exe 480 "C:\Users\Admin\AppData\Local\Temp\e435b6f60ed68fe29ad76ba055220264_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\aidgcri.exeC:\Windows\system32\aidgcri.exe 460 "C:\Windows\SysWOW64\yuadhrt.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\klbjrhy.exeC:\Windows\system32\klbjrhy.exe 464 "C:\Windows\SysWOW64\aidgcri.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\mrhlhzz.exeC:\Windows\system32\mrhlhzz.exe 468 "C:\Windows\SysWOW64\klbjrhy.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\lydtaxk.exeC:\Windows\system32\lydtaxk.exe 540 "C:\Windows\SysWOW64\mrhlhzz.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\iwkttep.exeC:\Windows\system32\iwkttep.exe 500 "C:\Windows\SysWOW64\lydtaxk.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\tmlzduu.exeC:\Windows\system32\tmlzduu.exe 520 "C:\Windows\SysWOW64\iwkttep.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\bjwwosg.exeC:\Windows\system32\bjwwosg.exe 524 "C:\Windows\SysWOW64\tmlzduu.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\dpdzekq.exeC:\Windows\system32\dpdzekq.exe 516 "C:\Windows\SysWOW64\bjwwosg.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\ceypvvi.exeC:\Windows\system32\ceypvvi.exe 536 "C:\Windows\SysWOW64\dpdzekq.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\clwmgqv.exeC:\Windows\system32\clwmgqv.exe 496 "C:\Windows\SysWOW64\ceypvvi.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\bexxilf.exeC:\Windows\system32\bexxilf.exe 472 "C:\Windows\SysWOW64\clwmgqv.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\kwihpdv.exeC:\Windows\system32\kwihpdv.exe 576 "C:\Windows\SysWOW64\bexxilf.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\sevzbte.exeC:\Windows\system32\sevzbte.exe 588 "C:\Windows\SysWOW64\kwihpdv.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\xbahpum.exeC:\Windows\system32\xbahpum.exe 580 "C:\Windows\SysWOW64\sevzbte.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\enzvmou.exeC:\Windows\system32\enzvmou.exe 596 "C:\Windows\SysWOW64\xbahpum.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2376 -
C:\Windows\SysWOW64\htnxcfv.exeC:\Windows\system32\htnxcfv.exe 584 "C:\Windows\SysWOW64\enzvmou.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:812 -
C:\Windows\SysWOW64\mjksqtg.exeC:\Windows\system32\mjksqtg.exe 604 "C:\Windows\SysWOW64\htnxcfv.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Windows\SysWOW64\rtangrm.exeC:\Windows\system32\rtangrm.exe 592 "C:\Windows\SysWOW64\mjksqtg.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2876 -
C:\Windows\SysWOW64\vbxicfy.exeC:\Windows\system32\vbxicfy.exe 612 "C:\Windows\SysWOW64\rtangrm.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2572 -
C:\Windows\SysWOW64\nmlkepi.exeC:\Windows\system32\nmlkepi.exe 600 "C:\Windows\SysWOW64\vbxicfy.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:944 -
C:\Windows\SysWOW64\xpjvrso.exeC:\Windows\system32\xpjvrso.exe 620 "C:\Windows\SysWOW64\nmlkepi.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2888 -
C:\Windows\SysWOW64\kubdzix.exeC:\Windows\system32\kubdzix.exe 608 "C:\Windows\SysWOW64\xpjvrso.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1140 -
C:\Windows\SysWOW64\tiuapqk.exeC:\Windows\system32\tiuapqk.exe 456 "C:\Windows\SysWOW64\kubdzix.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2988 -
C:\Windows\SysWOW64\yowscmh.exeC:\Windows\system32\yowscmh.exe 548 "C:\Windows\SysWOW64\tiuapqk.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464 -
C:\Windows\SysWOW64\igmyhcb.exeC:\Windows\system32\igmyhcb.exe 640 "C:\Windows\SysWOW64\yowscmh.exe"27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:784 -
C:\Windows\SysWOW64\prkdewr.exeC:\Windows\system32\prkdewr.exe 636 "C:\Windows\SysWOW64\igmyhcb.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:908 -
C:\Windows\SysWOW64\vstyubx.exeC:\Windows\system32\vstyubx.exe 648 "C:\Windows\SysWOW64\prkdewr.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068 -
C:\Windows\SysWOW64\wrhosyd.exeC:\Windows\system32\wrhosyd.exe 644 "C:\Windows\SysWOW64\vstyubx.exe"30⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Windows\SysWOW64\keqdycj.exeC:\Windows\system32\keqdycj.exe 652 "C:\Windows\SysWOW64\wrhosyd.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2552 -
C:\Windows\SysWOW64\ldetwhx.exeC:\Windows\system32\ldetwhx.exe 532 "C:\Windows\SysWOW64\keqdycj.exe"32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:304 -
C:\Windows\SysWOW64\wcqqgfw.exeC:\Windows\system32\wcqqgfw.exe 664 "C:\Windows\SysWOW64\ldetwhx.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Windows\SysWOW64\gugwlwy.exeC:\Windows\system32\gugwlwy.exe 544 "C:\Windows\SysWOW64\wcqqgfw.exe"34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2196 -
C:\Windows\SysWOW64\qtktdug.exeC:\Windows\system32\qtktdug.exe 680 "C:\Windows\SysWOW64\gugwlwy.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2288 -
C:\Windows\SysWOW64\spnwyvn.exeC:\Windows\system32\spnwyvn.exe 672 "C:\Windows\SysWOW64\qtktdug.exe"36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2300 -
C:\Windows\SysWOW64\crcgmyb.exeC:\Windows\system32\crcgmyb.exe 668 "C:\Windows\SysWOW64\spnwyvn.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2708 -
C:\Windows\SysWOW64\kzyggnc.exeC:\Windows\system32\kzyggnc.exe 676 "C:\Windows\SysWOW64\crcgmyb.exe"38⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:624 -
C:\Windows\SysWOW64\rdilpyn.exeC:\Windows\system32\rdilpyn.exe 684 "C:\Windows\SysWOW64\kzyggnc.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2652 -
C:\Windows\SysWOW64\wqttjis.exeC:\Windows\system32\wqttjis.exe 692 "C:\Windows\SysWOW64\rdilpyn.exe"40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776 -
C:\Windows\SysWOW64\jzxoldh.exeC:\Windows\system32\jzxoldh.exe 700 "C:\Windows\SysWOW64\wqttjis.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\Windows\SysWOW64\luargdo.exeC:\Windows\system32\luargdo.exe 660 "C:\Windows\SysWOW64\jzxoldh.exe"42⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Windows\SysWOW64\srkwyoz.exeC:\Windows\system32\srkwyoz.exe 696 "C:\Windows\SysWOW64\luargdo.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:752 -
C:\Windows\SysWOW64\avujphb.exeC:\Windows\system32\avujphb.exe 704 "C:\Windows\SysWOW64\srkwyoz.exe"44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Windows\SysWOW64\zcibbxl.exeC:\Windows\system32\zcibbxl.exe 708 "C:\Windows\SysWOW64\avujphb.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1988 -
C:\Windows\SysWOW64\fmqesuj.exeC:\Windows\system32\fmqesuj.exe 484 "C:\Windows\SysWOW64\zcibbxl.exe"46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Windows\SysWOW64\plccctq.exeC:\Windows\system32\plccctq.exe 716 "C:\Windows\SysWOW64\fmqesuj.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Windows\SysWOW64\oszmkwg.exeC:\Windows\system32\oszmkwg.exe 720 "C:\Windows\SysWOW64\plccctq.exe"48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2684 -
C:\Windows\SysWOW64\bjupswl.exeC:\Windows\system32\bjupswl.exe 728 "C:\Windows\SysWOW64\oszmkwg.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1716 -
C:\Windows\SysWOW64\iqqhfmv.exeC:\Windows\system32\iqqhfmv.exe 732 "C:\Windows\SysWOW64\bjupswl.exe"50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1172 -
C:\Windows\SysWOW64\vdzxkqu.exeC:\Windows\system32\vdzxkqu.exe 736 "C:\Windows\SysWOW64\iqqhfmv.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524 -
C:\Windows\SysWOW64\sivxrfm.exeC:\Windows\system32\sivxrfm.exe 492 "C:\Windows\SysWOW64\vdzxkqu.exe"52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1644 -
C:\Windows\SysWOW64\cakcwwg.exeC:\Windows\system32\cakcwwg.exe 744 "C:\Windows\SysWOW64\sivxrfm.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1368 -
C:\Windows\SysWOW64\zfoucdz.exeC:\Windows\system32\zfoucdz.exe 616 "C:\Windows\SysWOW64\cakcwwg.exe"54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3028 -
C:\Windows\SysWOW64\rqtmcaz.exeC:\Windows\system32\rqtmcaz.exe 752 "C:\Windows\SysWOW64\zfoucdz.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Windows\SysWOW64\bxfkvzh.exeC:\Windows\system32\bxfkvzh.exe 756 "C:\Windows\SysWOW64\rqtmcaz.exe"56⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:892 -
C:\Windows\SysWOW64\mwjpfyg.exeC:\Windows\system32\mwjpfyg.exe 748 "C:\Windows\SysWOW64\bxfkvzh.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2044 -
C:\Windows\SysWOW64\qbdxyit.exeC:\Windows\system32\qbdxyit.exe 712 "C:\Windows\SysWOW64\mwjpfyg.exe"58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2928 -
C:\Windows\SysWOW64\ddjfkmx.exeC:\Windows\system32\ddjfkmx.exe 776 "C:\Windows\SysWOW64\qbdxyit.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Windows\SysWOW64\yxovkfg.exeC:\Windows\system32\yxovkfg.exe 768 "C:\Windows\SysWOW64\ddjfkmx.exe"60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Windows\SysWOW64\kdfpywr.exeC:\Windows\system32\kdfpywr.exe 772 "C:\Windows\SysWOW64\yxovkfg.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Windows\SysWOW64\kvoisjb.exeC:\Windows\system32\kvoisjb.exe 504 "C:\Windows\SysWOW64\kdfpywr.exe"62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Windows\SysWOW64\xqyxyna.exeC:\Windows\system32\xqyxyna.exe 784 "C:\Windows\SysWOW64\kvoisjb.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Windows\SysWOW64\bycsutl.exeC:\Windows\system32\bycsutl.exe 780 "C:\Windows\SysWOW64\xqyxyna.exe"64⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444 -
C:\Windows\SysWOW64\jdnxdmo.exeC:\Windows\system32\jdnxdmo.exe 800 "C:\Windows\SysWOW64\bycsutl.exe"65⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\lnevviw.exeC:\Windows\system32\lnevviw.exe 572 "C:\Windows\SysWOW64\jdnxdmo.exe"66⤵PID:2440
-
C:\Windows\SysWOW64\yswqsrh.exeC:\Windows\system32\yswqsrh.exe 792 "C:\Windows\SysWOW64\lnevviw.exe"67⤵
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\iklvwhj.exeC:\Windows\system32\iklvwhj.exe 812 "C:\Windows\SysWOW64\yswqsrh.exe"68⤵PID:1052
-
C:\Windows\SysWOW64\pvkaljr.exeC:\Windows\system32\pvkaljr.exe 796 "C:\Windows\SysWOW64\iklvwhj.exe"69⤵PID:1612
-
C:\Windows\SysWOW64\ntramhw.exeC:\Windows\system32\ntramhw.exe 552 "C:\Windows\SysWOW64\pvkaljr.exe"70⤵PID:336
-
C:\Windows\SysWOW64\feetuff.exeC:\Windows\system32\feetuff.exe 816 "C:\Windows\SysWOW64\ntramhw.exe"71⤵
- Drops file in System32 directory
PID:1104 -
C:\Windows\SysWOW64\mlstgug.exeC:\Windows\system32\mlstgug.exe 788 "C:\Windows\SysWOW64\feetuff.exe"72⤵PID:1996
-
C:\Windows\SysWOW64\wlwqrto.exeC:\Windows\system32\wlwqrto.exe 824 "C:\Windows\SysWOW64\mlstgug.exe"73⤵PID:2748
-
C:\Windows\SysWOW64\bxpykda.exeC:\Windows\system32\bxpykda.exe 568 "C:\Windows\SysWOW64\wlwqrto.exe"74⤵PID:2156
-
C:\Windows\SysWOW64\goulgre.exeC:\Windows\system32\goulgre.exe 832 "C:\Windows\SysWOW64\bxpykda.exe"75⤵
- Drops file in System32 directory
PID:2732 -
C:\Windows\SysWOW64\tbmbmnl.exeC:\Windows\system32\tbmbmnl.exe 476 "C:\Windows\SysWOW64\goulgre.exe"76⤵
- Drops file in System32 directory
PID:2720 -
C:\Windows\SysWOW64\vwolhnr.exeC:\Windows\system32\vwolhnr.exe 840 "C:\Windows\SysWOW64\tbmbmnl.exe"77⤵PID:832
-
C:\Windows\SysWOW64\iqutszw.exeC:\Windows\system32\iqutszw.exe 844 "C:\Windows\SysWOW64\vwolhnr.exe"78⤵PID:3008
-
C:\Windows\SysWOW64\nzdojfc.exeC:\Windows\system32\nzdojfc.exe 836 "C:\Windows\SysWOW64\iqutszw.exe"79⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Windows\SysWOW64\xcsywai.exeC:\Windows\system32\xcsywai.exe 804 "C:\Windows\SysWOW64\nzdojfc.exe"80⤵
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\kpkocep.exeC:\Windows\system32\kpkocep.exe 864 "C:\Windows\SysWOW64\xcsywai.exe"81⤵
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\bhkgeqy.exeC:\Windows\system32\bhkgeqy.exe 560 "C:\Windows\SysWOW64\kpkocep.exe"82⤵PID:2024
-
C:\Windows\SysWOW64\ddnjzrf.exeC:\Windows\system32\ddnjzrf.exe 856 "C:\Windows\SysWOW64\bhkgeqy.exe"83⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\SysWOW64\gqqlurm.exeC:\Windows\system32\gqqlurm.exe 556 "C:\Windows\SysWOW64\ddnjzrf.exe"84⤵PID:2268
-
C:\Windows\SysWOW64\vgctbjp.exeC:\Windows\system32\vgctbjp.exe 868 "C:\Windows\SysWOW64\gqqlurm.exe"85⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Windows\SysWOW64\ixewjjv.exeC:\Windows\system32\ixewjjv.exe 872 "C:\Windows\SysWOW64\vgctbjp.exe"86⤵
- Drops file in System32 directory
PID:3040 -
C:\Windows\SysWOW64\qmsowgf.exeC:\Windows\system32\qmsowgf.exe 880 "C:\Windows\SysWOW64\ixewjjv.exe"87⤵PID:1992
-
C:\Windows\SysWOW64\rdgetds.exeC:\Windows\system32\rdgetds.exe 884 "C:\Windows\SysWOW64\qmsowgf.exe"88⤵PID:1788
-
C:\Windows\SysWOW64\hqgzxqp.exeC:\Windows\system32\hqgzxqp.exe 888 "C:\Windows\SysWOW64\rdgetds.exe"89⤵PID:876
-
C:\Windows\SysWOW64\eukzeyz.exeC:\Windows\system32\eukzeyz.exe 632 "C:\Windows\SysWOW64\hqgzxqp.exe"90⤵PID:1148
-
C:\Windows\SysWOW64\wbmebrb.exeC:\Windows\system32\wbmebrb.exe 900 "C:\Windows\SysWOW64\eukzeyz.exe"91⤵PID:1712
-
C:\Windows\SysWOW64\wxybgqk.exeC:\Windows\system32\wxybgqk.exe 624 "C:\Windows\SysWOW64\wbmebrb.exe"92⤵PID:2840
-
C:\Windows\SysWOW64\gwchqor.exeC:\Windows\system32\gwchqor.exe 912 "C:\Windows\SysWOW64\wxybgqk.exe"93⤵PID:2204
-
C:\Windows\SysWOW64\lykchmx.exeC:\Windows\system32\lykchmx.exe 724 "C:\Windows\SysWOW64\gwchqor.exe"94⤵PID:756
-
C:\Windows\SysWOW64\sngutbh.exeC:\Windows\system32\sngutbh.exe 908 "C:\Windows\SysWOW64\lykchmx.exe"95⤵PID:2028
-
C:\Windows\SysWOW64\ueujrgu.exeC:\Windows\system32\ueujrgu.exe 628 "C:\Windows\SysWOW64\sngutbh.exe"96⤵PID:1648
-
C:\Windows\SysWOW64\kufrxxq.exeC:\Windows\system32\kufrxxq.exe 924 "C:\Windows\SysWOW64\ueujrgu.exe"97⤵PID:2612
-
C:\Windows\SysWOW64\cyuczha.exeC:\Windows\system32\cyuczha.exe 916 "C:\Windows\SysWOW64\kufrxxq.exe"98⤵
- Drops file in System32 directory
PID:2496 -
C:\Windows\SysWOW64\pooxipg.exeC:\Windows\system32\pooxipg.exe 928 "C:\Windows\SysWOW64\cyuczha.exe"99⤵PID:2916
-
C:\Windows\SysWOW64\whvkfjw.exeC:\Windows\system32\whvkfjw.exe 920 "C:\Windows\SysWOW64\pooxipg.exe"100⤵PID:1456
-
C:\Windows\SysWOW64\dpicrzx.exeC:\Windows\system32\dpicrzx.exe 936 "C:\Windows\SysWOW64\whvkfjw.exe"101⤵PID:860
-
C:\Windows\SysWOW64\ohyhepz.exeC:\Windows\system32\ohyhepz.exe 940 "C:\Windows\SysWOW64\dpicrzx.exe"102⤵
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\xnzxuwm.exeC:\Windows\system32\xnzxuwm.exe 932 "C:\Windows\SysWOW64\ohyhepz.exe"103⤵PID:1676
-
C:\Windows\SysWOW64\foyxjdq.exeC:\Windows\system32\foyxjdq.exe 948 "C:\Windows\SysWOW64\xnzxuwm.exe"104⤵PID:1824
-
C:\Windows\SysWOW64\pnkutcq.exeC:\Windows\system32\pnkutcq.exe 952 "C:\Windows\SysWOW64\foyxjdq.exe"105⤵PID:1528
-
C:\Windows\SysWOW64\zyzfgfe.exeC:\Windows\system32\zyzfgfe.exe 956 "C:\Windows\SysWOW64\pnkutcq.exe"106⤵PID:684
-
C:\Windows\SysWOW64\ktsxwzf.exeC:\Windows\system32\ktsxwzf.exe 944 "C:\Windows\SysWOW64\zyzfgfe.exe"107⤵PID:1636
-
C:\Windows\SysWOW64\uwpijcl.exeC:\Windows\system32\uwpijcl.exe 968 "C:\Windows\SysWOW64\ktsxwzf.exe"108⤵PID:2164
-
C:\Windows\SysWOW64\basnaow.exeC:\Windows\system32\basnaow.exe 960 "C:\Windows\SysWOW64\uwpijcl.exe"109⤵PID:2388
-
C:\Windows\SysWOW64\oqupjwu.exeC:\Windows\system32\oqupjwu.exe 988 "C:\Windows\SysWOW64\basnaow.exe"110⤵PID:2216
-
C:\Windows\SysWOW64\vktvypk.exeC:\Windows\system32\vktvypk.exe 976 "C:\Windows\SysWOW64\oqupjwu.exe"111⤵PID:1664
-
C:\Windows\SysWOW64\dgdiqjn.exeC:\Windows\system32\dgdiqjn.exe 972 "C:\Windows\SysWOW64\vktvypk.exe"112⤵PID:584
-
C:\Windows\SysWOW64\qeykyjs.exeC:\Windows\system32\qeykyjs.exe 964 "C:\Windows\SysWOW64\dgdiqjn.exe"113⤵
- Drops file in System32 directory
PID:1488 -
C:\Windows\SysWOW64\adkijhs.exeC:\Windows\system32\adkijhs.exe 984 "C:\Windows\SysWOW64\qeykyjs.exe"114⤵
- Drops file in System32 directory
PID:2596 -
C:\Windows\SysWOW64\hlyadxb.exeC:\Windows\system32\hlyadxb.exe 980 "C:\Windows\SysWOW64\adkijhs.exe"115⤵PID:2380
-
C:\Windows\SysWOW64\uypyjbi.exeC:\Windows\system32\uypyjbi.exe 828 "C:\Windows\SysWOW64\hlyadxb.exe"116⤵PID:2936
-
C:\Windows\SysWOW64\ejfiweo.exeC:\Windows\system32\ejfiweo.exe 1004 "C:\Windows\SysWOW64\uypyjbi.exe"117⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Windows\SysWOW64\oijgodw.exeC:\Windows\system32\oijgodw.exe 996 "C:\Windows\SysWOW64\ejfiweo.exe"118⤵PID:1952
-
C:\Windows\SysWOW64\bylixlt.exeC:\Windows\system32\bylixlt.exe 1008 "C:\Windows\SysWOW64\oijgodw.exe"119⤵PID:1696
-
C:\Windows\SysWOW64\qwkiqkh.exeC:\Windows\system32\qwkiqkh.exe 1000 "C:\Windows\SysWOW64\bylixlt.exe"120⤵PID:1668
-
C:\Windows\SysWOW64\dyqqbwl.exeC:\Windows\system32\dyqqbwl.exe 1012 "C:\Windows\SysWOW64\qwkiqkh.exe"121⤵PID:2472
-
C:\Windows\SysWOW64\lcbdtho.exeC:\Windows\system32\lcbdtho.exe 1020 "C:\Windows\SysWOW64\dyqqbwl.exe"122⤵PID:1512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-