Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 16:59
Behavioral task
behavioral1
Sample
ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe
-
Size
168KB
-
MD5
ebca9fa879db0393656dcab8b157f83b
-
SHA1
6ec35c95e835f5aabd52b4ff9c61cce2c55cb1b8
-
SHA256
323418a8f2b9a75fcafe1d3173a338c881f6c97db760cf33c8e223fcf67eaf07
-
SHA512
5be7f9fc0c79637f2f88a1c428567eab6c5f8c416a0c98a3eb07f969b5939de7aa1e28f7f99ab4d3a4f7f8f2f66fac5228d89595d235b414bc710abf96eda34b
-
SSDEEP
3072:n4LqsDP/vfP/vfP/I4oYII9IX7IrX5kMEdQvfbzizb7j7rOizodjoeyZGpmS2aWS:IrXa3QLib37rOizaGZsmS2bqg6L
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1208 ¸´¼þ1~1.EXE 2264 ¸´¼þ1~1.EXE 5028 ¸´¼þ1~1.EXE 4820 ¸´¼þ1~1.EXE 3612 ¸´¼þ1~1.EXE 4304 ¸´¼þ1~1.EXE 3028 ¸´¼þ1~1.EXE 464 ¸´¼þ1~1.EXE 1552 ¸´¼þ1~1.EXE 3676 ¸´¼þ1~1.EXE 2312 ¸´¼þ1~1.EXE 436 ¸´¼þ1~1.EXE 3744 ¸´¼þ1~1.EXE 868 ¸´¼þ1~1.EXE 3724 ¸´¼þ1~1.EXE 3544 ¸´¼þ1~1.EXE 4876 ¸´¼þ1~1.EXE 5044 ¸´¼þ1~1.EXE 2292 ¸´¼þ1~1.EXE 2980 ¸´¼þ1~1.EXE 1200 ¸´¼þ1~1.EXE 1064 ¸´¼þ1~1.EXE 1556 ¸´¼þ1~1.EXE 384 ¸´¼þ1~1.EXE 4264 ¸´¼þ1~1.EXE 1948 ¸´¼þ1~1.EXE 3392 ¸´¼þ1~1.EXE 4832 ¸´¼þ1~1.EXE 3468 ¸´¼þ1~1.EXE 1356 ¸´¼þ1~1.EXE 3008 ¸´¼þ1~1.EXE 620 ¸´¼þ1~1.EXE 2840 ¸´¼þ1~1.EXE 224 ¸´¼þ1~1.EXE 216 ¸´¼þ1~1.EXE 2640 ¸´¼þ1~1.EXE 3084 ¸´¼þ1~1.EXE 4620 ¸´¼þ1~1.EXE 1540 ¸´¼þ1~1.EXE 5008 ¸´¼þ1~1.EXE 4252 ¸´¼þ1~1.EXE 4908 ¸´¼þ1~1.EXE 1336 ¸´¼þ1~1.EXE 4892 ¸´¼þ1~1.EXE 3436 ¸´¼þ1~1.EXE 540 ¸´¼þ1~1.EXE 1640 ¸´¼þ1~1.EXE 608 ¸´¼þ1~1.EXE 3980 ¸´¼þ1~1.EXE 4268 ¸´¼þ1~1.EXE 64 ¸´¼þ1~1.EXE 1564 ¸´¼þ1~1.EXE 3952 ¸´¼þ1~1.EXE 4888 ¸´¼þ1~1.EXE 4232 ¸´¼þ1~1.EXE 316 ¸´¼þ1~1.EXE 1668 ¸´¼þ1~1.EXE 5072 ¸´¼þ1~1.EXE 1704 ¸´¼þ1~1.EXE 2708 ¸´¼þ1~1.EXE 1816 ¸´¼þ1~1.EXE 3956 ¸´¼þ1~1.EXE 4024 ¸´¼þ1~1.EXE 3228 ¸´¼þ1~1.EXE -
resource yara_rule behavioral2/memory/740-0-0x0000000001000000-0x0000000001052000-memory.dmp vmprotect behavioral2/memory/740-72-0x0000000001000000-0x0000000001052000-memory.dmp vmprotect behavioral2/memory/740-74-0x0000000001000000-0x0000000001052000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ¸´¼þ1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 740 wrote to memory of 1208 740 ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe 82 PID 740 wrote to memory of 1208 740 ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe 82 PID 740 wrote to memory of 1208 740 ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe 82 PID 1208 wrote to memory of 2264 1208 ¸´¼þ1~1.EXE 83 PID 1208 wrote to memory of 2264 1208 ¸´¼þ1~1.EXE 83 PID 1208 wrote to memory of 2264 1208 ¸´¼þ1~1.EXE 83 PID 2264 wrote to memory of 5028 2264 ¸´¼þ1~1.EXE 84 PID 2264 wrote to memory of 5028 2264 ¸´¼þ1~1.EXE 84 PID 2264 wrote to memory of 5028 2264 ¸´¼þ1~1.EXE 84 PID 5028 wrote to memory of 4820 5028 ¸´¼þ1~1.EXE 85 PID 5028 wrote to memory of 4820 5028 ¸´¼þ1~1.EXE 85 PID 5028 wrote to memory of 4820 5028 ¸´¼þ1~1.EXE 85 PID 4820 wrote to memory of 3612 4820 ¸´¼þ1~1.EXE 86 PID 4820 wrote to memory of 3612 4820 ¸´¼þ1~1.EXE 86 PID 4820 wrote to memory of 3612 4820 ¸´¼þ1~1.EXE 86 PID 3612 wrote to memory of 4304 3612 ¸´¼þ1~1.EXE 87 PID 3612 wrote to memory of 4304 3612 ¸´¼þ1~1.EXE 87 PID 3612 wrote to memory of 4304 3612 ¸´¼þ1~1.EXE 87 PID 4304 wrote to memory of 3028 4304 ¸´¼þ1~1.EXE 88 PID 4304 wrote to memory of 3028 4304 ¸´¼þ1~1.EXE 88 PID 4304 wrote to memory of 3028 4304 ¸´¼þ1~1.EXE 88 PID 3028 wrote to memory of 464 3028 ¸´¼þ1~1.EXE 89 PID 3028 wrote to memory of 464 3028 ¸´¼þ1~1.EXE 89 PID 3028 wrote to memory of 464 3028 ¸´¼þ1~1.EXE 89 PID 464 wrote to memory of 1552 464 ¸´¼þ1~1.EXE 90 PID 464 wrote to memory of 1552 464 ¸´¼þ1~1.EXE 90 PID 464 wrote to memory of 1552 464 ¸´¼þ1~1.EXE 90 PID 1552 wrote to memory of 3676 1552 ¸´¼þ1~1.EXE 91 PID 1552 wrote to memory of 3676 1552 ¸´¼þ1~1.EXE 91 PID 1552 wrote to memory of 3676 1552 ¸´¼þ1~1.EXE 91 PID 3676 wrote to memory of 2312 3676 ¸´¼þ1~1.EXE 92 PID 3676 wrote to memory of 2312 3676 ¸´¼þ1~1.EXE 92 PID 3676 wrote to memory of 2312 3676 ¸´¼þ1~1.EXE 92 PID 2312 wrote to memory of 436 2312 ¸´¼þ1~1.EXE 93 PID 2312 wrote to memory of 436 2312 ¸´¼þ1~1.EXE 93 PID 2312 wrote to memory of 436 2312 ¸´¼þ1~1.EXE 93 PID 436 wrote to memory of 3744 436 ¸´¼þ1~1.EXE 94 PID 436 wrote to memory of 3744 436 ¸´¼þ1~1.EXE 94 PID 436 wrote to memory of 3744 436 ¸´¼þ1~1.EXE 94 PID 3744 wrote to memory of 868 3744 ¸´¼þ1~1.EXE 95 PID 3744 wrote to memory of 868 3744 ¸´¼þ1~1.EXE 95 PID 3744 wrote to memory of 868 3744 ¸´¼þ1~1.EXE 95 PID 868 wrote to memory of 3724 868 ¸´¼þ1~1.EXE 96 PID 868 wrote to memory of 3724 868 ¸´¼þ1~1.EXE 96 PID 868 wrote to memory of 3724 868 ¸´¼þ1~1.EXE 96 PID 3724 wrote to memory of 3544 3724 ¸´¼þ1~1.EXE 97 PID 3724 wrote to memory of 3544 3724 ¸´¼þ1~1.EXE 97 PID 3724 wrote to memory of 3544 3724 ¸´¼þ1~1.EXE 97 PID 3544 wrote to memory of 4876 3544 ¸´¼þ1~1.EXE 98 PID 3544 wrote to memory of 4876 3544 ¸´¼þ1~1.EXE 98 PID 3544 wrote to memory of 4876 3544 ¸´¼þ1~1.EXE 98 PID 4876 wrote to memory of 5044 4876 ¸´¼þ1~1.EXE 99 PID 4876 wrote to memory of 5044 4876 ¸´¼þ1~1.EXE 99 PID 4876 wrote to memory of 5044 4876 ¸´¼þ1~1.EXE 99 PID 5044 wrote to memory of 2292 5044 ¸´¼þ1~1.EXE 100 PID 5044 wrote to memory of 2292 5044 ¸´¼þ1~1.EXE 100 PID 5044 wrote to memory of 2292 5044 ¸´¼þ1~1.EXE 100 PID 2292 wrote to memory of 2980 2292 ¸´¼þ1~1.EXE 101 PID 2292 wrote to memory of 2980 2292 ¸´¼þ1~1.EXE 101 PID 2292 wrote to memory of 2980 2292 ¸´¼þ1~1.EXE 101 PID 2980 wrote to memory of 1200 2980 ¸´¼þ1~1.EXE 102 PID 2980 wrote to memory of 1200 2980 ¸´¼þ1~1.EXE 102 PID 2980 wrote to memory of 1200 2980 ¸´¼þ1~1.EXE 102 PID 1200 wrote to memory of 1064 1200 ¸´¼þ1~1.EXE 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebca9fa879db0393656dcab8b157f83b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE23⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE24⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE25⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE26⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE27⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE28⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE29⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE30⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE31⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE32⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE33⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE34⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE35⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE36⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE37⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE38⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE39⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE40⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE42⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE43⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE44⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE45⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE46⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE47⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE48⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE49⤵
- Executes dropped EXE
PID:608 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE50⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE51⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE52⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE53⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE54⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE55⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE56⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE57⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE58⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE59⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE60⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE61⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE62⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE63⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE64⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE65⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE66⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE67⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE68⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE69⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE70⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE71⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE72⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE73⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE74⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE75⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE76⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE77⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE78⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE79⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE80⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE81⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE82⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE83⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE84⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE85⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE86⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE87⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE88⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE89⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE90⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE91⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE92⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE93⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE94⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE95⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE96⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE97⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE98⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE99⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE100⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE101⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE102⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE103⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE104⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE105⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE106⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE107⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE108⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE109⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE110⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE111⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE112⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE113⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE114⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE115⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE116⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE117⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE118⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE119⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE120⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE121⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ1~1.EXE122⤵PID:4632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-