Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/09/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe
-
Size
150KB
-
MD5
f887b8113986c093b5aaa161413db5f6
-
SHA1
50601d8d1996b5ecdea292bff5dcee3b85ae26d5
-
SHA256
f7caac4912b9c34a9dd0ce99c91899ce6a24d3ded02d0321d21ac85defc46c34
-
SHA512
59555ae0a00b7659aaaa893853d2848147c747d0565e0b23ba3ec5163b547081e10b45489c9b9cbe0e49ed1eed3e3382da4580e9ecbaa453b6367a9cfe1efb45
-
SSDEEP
3072:viGFSUCzK7GBTEhE37TW9PjGL6+eNvPgj5j2dcRWG5IL6exdwjLiT:v5R7WTbrTULGmTdPgFj2d5/JgjLY
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 64 IoCs
pid Process 2776 dinbulmqj.exe 2312 yvcluwrzd.exe 2724 limbasqmk.exe 1700 susgxuyye.exe 576 fhcedpxds.exe 2176 nwxwpngvr.exe 2288 anszynmcs.exe 1236 kmewqmtcs.exe 2864 xkzzzurjl.exe 868 hnojmxflg.exe 2536 udjmvxdsz.exe 2404 gfpbgkpcm.exe 2268 onluazrmt.exe 840 ymprlyymt.exe 1160 itbodxgmu.exe 1544 vgkejbfya.exe 924 fjiowelsv.exe 1300 ptxzrhzuh.exe 1096 ebjhqqvjb.exe 2428 radkzzaqc.exe 1720 eckzsdfap.exe 1592 oxkkaxnxd.exe 2764 ejhxjtqoj.exe 2792 lcgkznybv.exe 2696 avdxibasj.exe 2628 dvpubaisj.exe 2272 scachrmgc.exe 1656 cnqmvmsjp.exe 2172 mmukflzix.exe 1904 wlghxkhix.exe 2328 mygctxece.exe 2900 xxsamwlue.exe 2052 gltxcdqye.exe 2656 tboakewge.exe 1640 gsictmcnf.exe 2228 qzvalljmf.exe 1772 ghgisufbz.exe 1016 nafnhovot.exe 1500 aulvtazxy.exe 1864 kbxalzhxy.exe 2544 xogqrdgcn.exe 908 hreaegmez.exe 1624 uenqkcljo.exe 1816 bxmvhebda.exe 2920 orslsiffn.exe 2524 bekaymesb.exe 2124 ocfdhukzc.exe 2884 volieoslo.exe 2564 iqrypswvb.exe 1028 spvvarevc.exe 1248 hfhvgjhjv.exe 1924 setbrhpjv.exe 2056 cgidmdvli.exe 1996 pbabsguqw.exe 2188 bvgidtyzk.exe 1980 lckgosgzk.exe 2832 ytfiwslgl.exe 856 jsroprtgl.exe 2216 vuxvadxqy.exe 1672 ftbtlcfpy.exe 1528 svhjwojre.exe 1820 flklnphye.exe 2976 plojxnoyf.exe 608 zssghmwxf.exe -
Loads dropped DLL 64 IoCs
pid Process 2688 f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe 2688 f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe 2776 dinbulmqj.exe 2776 dinbulmqj.exe 2312 yvcluwrzd.exe 2312 yvcluwrzd.exe 2724 limbasqmk.exe 2724 limbasqmk.exe 1700 susgxuyye.exe 1700 susgxuyye.exe 576 fhcedpxds.exe 576 fhcedpxds.exe 2176 nwxwpngvr.exe 2176 nwxwpngvr.exe 2288 anszynmcs.exe 2288 anszynmcs.exe 1236 kmewqmtcs.exe 1236 kmewqmtcs.exe 2864 xkzzzurjl.exe 2864 xkzzzurjl.exe 868 hnojmxflg.exe 868 hnojmxflg.exe 2536 udjmvxdsz.exe 2536 udjmvxdsz.exe 2404 gfpbgkpcm.exe 2404 gfpbgkpcm.exe 2268 onluazrmt.exe 2268 onluazrmt.exe 840 ymprlyymt.exe 840 ymprlyymt.exe 1160 itbodxgmu.exe 1160 itbodxgmu.exe 1544 vgkejbfya.exe 1544 vgkejbfya.exe 924 fjiowelsv.exe 924 fjiowelsv.exe 1300 ptxzrhzuh.exe 1300 ptxzrhzuh.exe 1096 ebjhqqvjb.exe 1096 ebjhqqvjb.exe 2428 radkzzaqc.exe 2428 radkzzaqc.exe 1720 eckzsdfap.exe 1720 eckzsdfap.exe 1592 oxkkaxnxd.exe 1592 oxkkaxnxd.exe 2764 ejhxjtqoj.exe 2764 ejhxjtqoj.exe 2792 lcgkznybv.exe 2792 lcgkznybv.exe 2696 avdxibasj.exe 2696 avdxibasj.exe 2628 dvpubaisj.exe 2628 dvpubaisj.exe 2272 scachrmgc.exe 2272 scachrmgc.exe 1656 cnqmvmsjp.exe 1656 cnqmvmsjp.exe 2172 mmukflzix.exe 2172 mmukflzix.exe 1904 wlghxkhix.exe 1904 wlghxkhix.exe 2328 mygctxece.exe 2328 mygctxece.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\stbwaehvo.exe gznohrcma.exe File opened for modification C:\Windows\SysWOW64\zosfwsdex.exe mpxdosxxe.exe File opened for modification C:\Windows\SysWOW64\xfzzcxlnq.exe kgwwtpogx.exe File opened for modification C:\Windows\SysWOW64\bglpqpwaa.exe rdofcmpfo.exe File opened for modification C:\Windows\SysWOW64\qsskwayef.exe dqmvlvmvr.exe File opened for modification C:\Windows\SysWOW64\ahhkzpely.exe nqmhqhzwx.exe File opened for modification C:\Windows\SysWOW64\xobamkqnh.exe hkbfixtta.exe File opened for modification C:\Windows\SysWOW64\dolpimume.exe qqimzeowl.exe File opened for modification C:\Windows\SysWOW64\bznogbitp.exe ojtlpbcmo.exe File opened for modification C:\Windows\SysWOW64\cpajdnfas.exe tjzufgsdt.exe File created C:\Windows\SysWOW64\jzowdlsrx.exe wittudnje.exe File opened for modification C:\Windows\SysWOW64\bebrtttzh.exe pkvbhhhqu.exe File opened for modification C:\Windows\SysWOW64\atghouepe.exe qffkquztf.exe File created C:\Windows\SysWOW64\uenqkcljo.exe hreaegmez.exe File created C:\Windows\SysWOW64\zkdnsgtdl.exe qhndfcfby.exe File created C:\Windows\SysWOW64\busgdnjph.exe rfrrngwsi.exe File created C:\Windows\SysWOW64\foielwget.exe spnbdoixs.exe File created C:\Windows\SysWOW64\qduffrnqd.exe djopufjhy.exe File opened for modification C:\Windows\SysWOW64\jombctvfz.exe wxjyllqyy.exe File created C:\Windows\SysWOW64\ydejmqxeq.exe lmbhdizxp.exe File opened for modification C:\Windows\SysWOW64\kmewqmtcs.exe anszynmcs.exe File opened for modification C:\Windows\SysWOW64\uenqkcljo.exe hreaegmez.exe File opened for modification C:\Windows\SysWOW64\tonxaqwkl.exe gpsuriydk.exe File created C:\Windows\SysWOW64\djrmzukid.exe qswjrmfbk.exe File opened for modification C:\Windows\SysWOW64\eudoyhlvf.exe rdilpynoe.exe File created C:\Windows\SysWOW64\fbgklbtao.exe szavzwpyi.exe File created C:\Windows\SysWOW64\kgwwtpogx.exe xqbuchizw.exe File created C:\Windows\SysWOW64\vlhflydtb.exe junccpfma.exe File created C:\Windows\SysWOW64\ghccbhviz.exe tqhashxbh.exe File created C:\Windows\SysWOW64\tfffjpapa.exe ghccbhviz.exe File opened for modification C:\Windows\SysWOW64\kkfvtokkv.exe aaqkxleqi.exe File opened for modification C:\Windows\SysWOW64\tbsmyrfez.exe jydbloqcn.exe File created C:\Windows\SysWOW64\tjzufgsdt.exe goqeactrf.exe File opened for modification C:\Windows\SysWOW64\hxtrmurhe.exe ukbtgzkcy.exe File opened for modification C:\Windows\SysWOW64\fmsjsrahz.exe awphjjuag.exe File created C:\Windows\SysWOW64\xerxwegcp.exe kfpunwavp.exe File opened for modification C:\Windows\SysWOW64\leozffdqn.exe bqojhxyto.exe File created C:\Windows\SysWOW64\fxtrtxsdb.exe vmegyumio.exe File created C:\Windows\SysWOW64\tvlfjjseu.exe jokhlbfhv.exe File opened for modification C:\Windows\SysWOW64\oqcjmsilj.exe bdtugwbgu.exe File created C:\Windows\SysWOW64\tzmtrxdcd.exe gxglflzbx.exe File opened for modification C:\Windows\SysWOW64\pntjjlsah.exe bacudhmvt.exe File created C:\Windows\SysWOW64\aipqdackl.exe nsvnurwdk.exe File created C:\Windows\SysWOW64\ufwpaeavo.exe kdgfnbubb.exe File created C:\Windows\SysWOW64\hwzsimgkp.exe ufwpaeavo.exe File created C:\Windows\SysWOW64\viligjmpt.exe mfoylogvg.exe File opened for modification C:\Windows\SysWOW64\lxlbeaojv.exe yhjzvricv.exe File created C:\Windows\SysWOW64\iyfqaoooh.exe vhcnrgiho.exe File opened for modification C:\Windows\SysWOW64\eesgfafii.exe rcmrtobgv.exe File created C:\Windows\SysWOW64\fzwllgnoo.exe sibicfphn.exe File created C:\Windows\SysWOW64\vokrthrto.exe jyhplzlmn.exe File created C:\Windows\SysWOW64\zdiiaccmt.exe mnngrtwfs.exe File created C:\Windows\SysWOW64\fmygucnbu.exe sksqjpjsg.exe File opened for modification C:\Windows\SysWOW64\uspkucsad.exe htvhltntc.exe File created C:\Windows\SysWOW64\ijxtwbmhn.exe vhrdkxhxz.exe File opened for modification C:\Windows\SysWOW64\fjiowelsv.exe vgkejbfya.exe File created C:\Windows\SysWOW64\lcgkznybv.exe ejhxjtqoj.exe File opened for modification C:\Windows\SysWOW64\kbxalzhxy.exe aulvtazxy.exe File opened for modification C:\Windows\SysWOW64\vfxinzrdg.exe mzftpsehh.exe File created C:\Windows\SysWOW64\ahhcnnamh.exe qfjsakukm.exe File opened for modification C:\Windows\SysWOW64\hmlonskwc.exe xylyxlxav.exe File created C:\Windows\SysWOW64\psfypvzde.exe dqzidjvtr.exe File created C:\Windows\SysWOW64\cwoarqgyf.exe qgtxjiarf.exe File created C:\Windows\SysWOW64\vopbwsulh.exe iynynrxvg.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language udtlfraqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ozvgwpftq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ijxtwbmhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ivqujdysy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxcziojd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wdqxzjdnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qffkquztf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fzzpokvlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xmggjhtoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbgklbtao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tzmtrxdcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffmjwjqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnstcnqqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dsbxjrrnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ywgematqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ergwlhtva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvfugdgvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zkdnsgtdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpideitpu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ktoltfalk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htvhltntc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zbraqyycf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language niavrtncm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qmipkaosx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zgsavuwyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nkjwnemlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxfkvzhyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qgtxjiarf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aulvtazxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahhcnnamh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txkvucbcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abalmrrwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ybrljvcek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ucoqebqdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jwhpvtatq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ugqueptwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ojtlpbcmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language klbjrhyvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ymgakchdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xcbrstidc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aipqdackl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gpansrwls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language labjnwrtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aqtmqukpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gtjtmbnsw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjysmhvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bebrtttzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhrdkxhxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kdgfnbubb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qauhkpagk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdpmzosdw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xqbuchizw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sgabbrwmu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ngspalpwp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfimmiwtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvyptpua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wndkwfkbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zckjxsgif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlenixmxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mzwcyfzty.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language slgaoxkba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mnakbsxxg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbdttzmph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2776 2688 f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe 30 PID 2688 wrote to memory of 2776 2688 f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe 30 PID 2688 wrote to memory of 2776 2688 f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe 30 PID 2688 wrote to memory of 2776 2688 f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe 30 PID 2776 wrote to memory of 2312 2776 dinbulmqj.exe 31 PID 2776 wrote to memory of 2312 2776 dinbulmqj.exe 31 PID 2776 wrote to memory of 2312 2776 dinbulmqj.exe 31 PID 2776 wrote to memory of 2312 2776 dinbulmqj.exe 31 PID 2312 wrote to memory of 2724 2312 yvcluwrzd.exe 32 PID 2312 wrote to memory of 2724 2312 yvcluwrzd.exe 32 PID 2312 wrote to memory of 2724 2312 yvcluwrzd.exe 32 PID 2312 wrote to memory of 2724 2312 yvcluwrzd.exe 32 PID 2724 wrote to memory of 1700 2724 limbasqmk.exe 33 PID 2724 wrote to memory of 1700 2724 limbasqmk.exe 33 PID 2724 wrote to memory of 1700 2724 limbasqmk.exe 33 PID 2724 wrote to memory of 1700 2724 limbasqmk.exe 33 PID 1700 wrote to memory of 576 1700 susgxuyye.exe 34 PID 1700 wrote to memory of 576 1700 susgxuyye.exe 34 PID 1700 wrote to memory of 576 1700 susgxuyye.exe 34 PID 1700 wrote to memory of 576 1700 susgxuyye.exe 34 PID 576 wrote to memory of 2176 576 fhcedpxds.exe 35 PID 576 wrote to memory of 2176 576 fhcedpxds.exe 35 PID 576 wrote to memory of 2176 576 fhcedpxds.exe 35 PID 576 wrote to memory of 2176 576 fhcedpxds.exe 35 PID 2176 wrote to memory of 2288 2176 nwxwpngvr.exe 36 PID 2176 wrote to memory of 2288 2176 nwxwpngvr.exe 36 PID 2176 wrote to memory of 2288 2176 nwxwpngvr.exe 36 PID 2176 wrote to memory of 2288 2176 nwxwpngvr.exe 36 PID 2288 wrote to memory of 1236 2288 anszynmcs.exe 37 PID 2288 wrote to memory of 1236 2288 anszynmcs.exe 37 PID 2288 wrote to memory of 1236 2288 anszynmcs.exe 37 PID 2288 wrote to memory of 1236 2288 anszynmcs.exe 37 PID 1236 wrote to memory of 2864 1236 kmewqmtcs.exe 38 PID 1236 wrote to memory of 2864 1236 kmewqmtcs.exe 38 PID 1236 wrote to memory of 2864 1236 kmewqmtcs.exe 38 PID 1236 wrote to memory of 2864 1236 kmewqmtcs.exe 38 PID 2864 wrote to memory of 868 2864 xkzzzurjl.exe 39 PID 2864 wrote to memory of 868 2864 xkzzzurjl.exe 39 PID 2864 wrote to memory of 868 2864 xkzzzurjl.exe 39 PID 2864 wrote to memory of 868 2864 xkzzzurjl.exe 39 PID 868 wrote to memory of 2536 868 hnojmxflg.exe 40 PID 868 wrote to memory of 2536 868 hnojmxflg.exe 40 PID 868 wrote to memory of 2536 868 hnojmxflg.exe 40 PID 868 wrote to memory of 2536 868 hnojmxflg.exe 40 PID 2536 wrote to memory of 2404 2536 udjmvxdsz.exe 41 PID 2536 wrote to memory of 2404 2536 udjmvxdsz.exe 41 PID 2536 wrote to memory of 2404 2536 udjmvxdsz.exe 41 PID 2536 wrote to memory of 2404 2536 udjmvxdsz.exe 41 PID 2404 wrote to memory of 2268 2404 gfpbgkpcm.exe 42 PID 2404 wrote to memory of 2268 2404 gfpbgkpcm.exe 42 PID 2404 wrote to memory of 2268 2404 gfpbgkpcm.exe 42 PID 2404 wrote to memory of 2268 2404 gfpbgkpcm.exe 42 PID 2268 wrote to memory of 840 2268 onluazrmt.exe 43 PID 2268 wrote to memory of 840 2268 onluazrmt.exe 43 PID 2268 wrote to memory of 840 2268 onluazrmt.exe 43 PID 2268 wrote to memory of 840 2268 onluazrmt.exe 43 PID 840 wrote to memory of 1160 840 ymprlyymt.exe 44 PID 840 wrote to memory of 1160 840 ymprlyymt.exe 44 PID 840 wrote to memory of 1160 840 ymprlyymt.exe 44 PID 840 wrote to memory of 1160 840 ymprlyymt.exe 44 PID 1160 wrote to memory of 1544 1160 itbodxgmu.exe 45 PID 1160 wrote to memory of 1544 1160 itbodxgmu.exe 45 PID 1160 wrote to memory of 1544 1160 itbodxgmu.exe 45 PID 1160 wrote to memory of 1544 1160 itbodxgmu.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\dinbulmqj.exeC:\Windows\system32\dinbulmqj.exe 476 "C:\Users\Admin\AppData\Local\Temp\f887b8113986c093b5aaa161413db5f6_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\yvcluwrzd.exeC:\Windows\system32\yvcluwrzd.exe 540 "C:\Windows\SysWOW64\dinbulmqj.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\limbasqmk.exeC:\Windows\system32\limbasqmk.exe 556 "C:\Windows\SysWOW64\yvcluwrzd.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\susgxuyye.exeC:\Windows\system32\susgxuyye.exe 552 "C:\Windows\SysWOW64\limbasqmk.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\fhcedpxds.exeC:\Windows\system32\fhcedpxds.exe 544 "C:\Windows\SysWOW64\susgxuyye.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\nwxwpngvr.exeC:\Windows\system32\nwxwpngvr.exe 548 "C:\Windows\SysWOW64\fhcedpxds.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\anszynmcs.exeC:\Windows\system32\anszynmcs.exe 532 "C:\Windows\SysWOW64\nwxwpngvr.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\kmewqmtcs.exeC:\Windows\system32\kmewqmtcs.exe 564 "C:\Windows\SysWOW64\anszynmcs.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\xkzzzurjl.exeC:\Windows\system32\xkzzzurjl.exe 536 "C:\Windows\SysWOW64\kmewqmtcs.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\hnojmxflg.exeC:\Windows\system32\hnojmxflg.exe 572 "C:\Windows\SysWOW64\xkzzzurjl.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\udjmvxdsz.exeC:\Windows\system32\udjmvxdsz.exe 560 "C:\Windows\SysWOW64\hnojmxflg.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\gfpbgkpcm.exeC:\Windows\system32\gfpbgkpcm.exe 576 "C:\Windows\SysWOW64\udjmvxdsz.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\onluazrmt.exeC:\Windows\system32\onluazrmt.exe 568 "C:\Windows\SysWOW64\gfpbgkpcm.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\ymprlyymt.exeC:\Windows\system32\ymprlyymt.exe 580 "C:\Windows\SysWOW64\onluazrmt.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\itbodxgmu.exeC:\Windows\system32\itbodxgmu.exe 584 "C:\Windows\SysWOW64\ymprlyymt.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\vgkejbfya.exeC:\Windows\system32\vgkejbfya.exe 604 "C:\Windows\SysWOW64\itbodxgmu.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\fjiowelsv.exeC:\Windows\system32\fjiowelsv.exe 596 "C:\Windows\SysWOW64\vgkejbfya.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Windows\SysWOW64\ptxzrhzuh.exeC:\Windows\system32\ptxzrhzuh.exe 588 "C:\Windows\SysWOW64\fjiowelsv.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Windows\SysWOW64\ebjhqqvjb.exeC:\Windows\system32\ebjhqqvjb.exe 592 "C:\Windows\SysWOW64\ptxzrhzuh.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Windows\SysWOW64\radkzzaqc.exeC:\Windows\system32\radkzzaqc.exe 612 "C:\Windows\SysWOW64\ebjhqqvjb.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Windows\SysWOW64\eckzsdfap.exeC:\Windows\system32\eckzsdfap.exe 600 "C:\Windows\SysWOW64\radkzzaqc.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\oxkkaxnxd.exeC:\Windows\system32\oxkkaxnxd.exe 624 "C:\Windows\SysWOW64\eckzsdfap.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Windows\SysWOW64\ejhxjtqoj.exeC:\Windows\system32\ejhxjtqoj.exe 608 "C:\Windows\SysWOW64\oxkkaxnxd.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\lcgkznybv.exeC:\Windows\system32\lcgkznybv.exe 620 "C:\Windows\SysWOW64\ejhxjtqoj.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Windows\SysWOW64\avdxibasj.exeC:\Windows\system32\avdxibasj.exe 616 "C:\Windows\SysWOW64\lcgkznybv.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Windows\SysWOW64\dvpubaisj.exeC:\Windows\system32\dvpubaisj.exe 636 "C:\Windows\SysWOW64\avdxibasj.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Windows\SysWOW64\scachrmgc.exeC:\Windows\system32\scachrmgc.exe 628 "C:\Windows\SysWOW64\dvpubaisj.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Windows\SysWOW64\cnqmvmsjp.exeC:\Windows\system32\cnqmvmsjp.exe 640 "C:\Windows\SysWOW64\scachrmgc.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Windows\SysWOW64\mmukflzix.exeC:\Windows\system32\mmukflzix.exe 632 "C:\Windows\SysWOW64\cnqmvmsjp.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Windows\SysWOW64\wlghxkhix.exeC:\Windows\system32\wlghxkhix.exe 644 "C:\Windows\SysWOW64\mmukflzix.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Windows\SysWOW64\mygctxece.exeC:\Windows\system32\mygctxece.exe 648 "C:\Windows\SysWOW64\wlghxkhix.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Windows\SysWOW64\xxsamwlue.exeC:\Windows\system32\xxsamwlue.exe 660 "C:\Windows\SysWOW64\mygctxece.exe"33⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\gltxcdqye.exeC:\Windows\system32\gltxcdqye.exe 656 "C:\Windows\SysWOW64\xxsamwlue.exe"34⤵
- Executes dropped EXE
PID:2052 -
C:\Windows\SysWOW64\tboakewge.exeC:\Windows\system32\tboakewge.exe 668 "C:\Windows\SysWOW64\gltxcdqye.exe"35⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\gsictmcnf.exeC:\Windows\system32\gsictmcnf.exe 652 "C:\Windows\SysWOW64\tboakewge.exe"36⤵
- Executes dropped EXE
PID:1640 -
C:\Windows\SysWOW64\qzvalljmf.exeC:\Windows\system32\qzvalljmf.exe 676 "C:\Windows\SysWOW64\gsictmcnf.exe"37⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\ghgisufbz.exeC:\Windows\system32\ghgisufbz.exe 664 "C:\Windows\SysWOW64\qzvalljmf.exe"38⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\nafnhovot.exeC:\Windows\system32\nafnhovot.exe 672 "C:\Windows\SysWOW64\ghgisufbz.exe"39⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\aulvtazxy.exeC:\Windows\system32\aulvtazxy.exe 680 "C:\Windows\SysWOW64\nafnhovot.exe"40⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\kbxalzhxy.exeC:\Windows\system32\kbxalzhxy.exe 684 "C:\Windows\SysWOW64\aulvtazxy.exe"41⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\SysWOW64\xogqrdgcn.exeC:\Windows\system32\xogqrdgcn.exe 688 "C:\Windows\SysWOW64\kbxalzhxy.exe"42⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\hreaegmez.exeC:\Windows\system32\hreaegmez.exe 692 "C:\Windows\SysWOW64\xogqrdgcn.exe"43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:908 -
C:\Windows\SysWOW64\uenqkcljo.exeC:\Windows\system32\uenqkcljo.exe 708 "C:\Windows\SysWOW64\hreaegmez.exe"44⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\SysWOW64\bxmvhebda.exeC:\Windows\system32\bxmvhebda.exe 712 "C:\Windows\SysWOW64\uenqkcljo.exe"45⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\orslsiffn.exeC:\Windows\system32\orslsiffn.exe 696 "C:\Windows\SysWOW64\bxmvhebda.exe"46⤵
- Executes dropped EXE
PID:2920 -
C:\Windows\SysWOW64\bekaymesb.exeC:\Windows\system32\bekaymesb.exe 700 "C:\Windows\SysWOW64\orslsiffn.exe"47⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\ocfdhukzc.exeC:\Windows\system32\ocfdhukzc.exe 704 "C:\Windows\SysWOW64\bekaymesb.exe"48⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\volieoslo.exeC:\Windows\system32\volieoslo.exe 716 "C:\Windows\SysWOW64\ocfdhukzc.exe"49⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\iqrypswvb.exeC:\Windows\system32\iqrypswvb.exe 720 "C:\Windows\SysWOW64\volieoslo.exe"50⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\spvvarevc.exeC:\Windows\system32\spvvarevc.exe 740 "C:\Windows\SysWOW64\iqrypswvb.exe"51⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\hfhvgjhjv.exeC:\Windows\system32\hfhvgjhjv.exe 724 "C:\Windows\SysWOW64\spvvarevc.exe"52⤵
- Executes dropped EXE
PID:1248 -
C:\Windows\SysWOW64\setbrhpjv.exeC:\Windows\system32\setbrhpjv.exe 736 "C:\Windows\SysWOW64\hfhvgjhjv.exe"53⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\SysWOW64\cgidmdvli.exeC:\Windows\system32\cgidmdvli.exe 732 "C:\Windows\SysWOW64\setbrhpjv.exe"54⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\SysWOW64\pbabsguqw.exeC:\Windows\system32\pbabsguqw.exe 748 "C:\Windows\SysWOW64\cgidmdvli.exe"55⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\bvgidtyzk.exeC:\Windows\system32\bvgidtyzk.exe 728 "C:\Windows\SysWOW64\pbabsguqw.exe"56⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\SysWOW64\lckgosgzk.exeC:\Windows\system32\lckgosgzk.exe 744 "C:\Windows\SysWOW64\bvgidtyzk.exe"57⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\ytfiwslgl.exeC:\Windows\system32\ytfiwslgl.exe 756 "C:\Windows\SysWOW64\lckgosgzk.exe"58⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\jsroprtgl.exeC:\Windows\system32\jsroprtgl.exe 752 "C:\Windows\SysWOW64\ytfiwslgl.exe"59⤵
- Executes dropped EXE
PID:856 -
C:\Windows\SysWOW64\vuxvadxqy.exeC:\Windows\system32\vuxvadxqy.exe 760 "C:\Windows\SysWOW64\jsroprtgl.exe"60⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\ftbtlcfpy.exeC:\Windows\system32\ftbtlcfpy.exe 780 "C:\Windows\SysWOW64\vuxvadxqy.exe"61⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\svhjwojre.exeC:\Windows\system32\svhjwojre.exe 764 "C:\Windows\SysWOW64\ftbtlcfpy.exe"62⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\flklnphye.exeC:\Windows\system32\flklnphye.exe 772 "C:\Windows\SysWOW64\svhjwojre.exe"63⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\plojxnoyf.exeC:\Windows\system32\plojxnoyf.exe 776 "C:\Windows\SysWOW64\flklnphye.exe"64⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\zssghmwxf.exeC:\Windows\system32\zssghmwxf.exe 768 "C:\Windows\SysWOW64\plojxnoyf.exe"65⤵
- Executes dropped EXE
PID:608 -
C:\Windows\SysWOW64\juqqdpcar.exeC:\Windows\system32\juqqdpcar.exe 784 "C:\Windows\SysWOW64\zssghmwxf.exe"66⤵PID:1288
-
C:\Windows\SysWOW64\whzgitjeg.exeC:\Windows\system32\whzgitjeg.exe 804 "C:\Windows\SysWOW64\juqqdpcar.exe"67⤵PID:2996
-
C:\Windows\SysWOW64\jjfwuynot.exeC:\Windows\system32\jjfwuynot.exe 788 "C:\Windows\SysWOW64\whzgitjeg.exe"68⤵PID:1488
-
C:\Windows\SysWOW64\waizcglvu.exeC:\Windows\system32\waizcglvu.exe 792 "C:\Windows\SysWOW64\jjfwuynot.exe"69⤵PID:896
-
C:\Windows\SysWOW64\jydbloqcn.exeC:\Windows\system32\jydbloqcn.exe 796 "C:\Windows\SysWOW64\waizcglvu.exe"70⤵
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\tbsmyrfez.exeC:\Windows\system32\tbsmyrfez.exe 816 "C:\Windows\SysWOW64\jydbloqcn.exe"71⤵PID:2292
-
C:\Windows\SysWOW64\gznohrcma.exeC:\Windows\system32\gznohrcma.exe 800 "C:\Windows\SysWOW64\tbsmyrfez.exe"72⤵
- Drops file in System32 directory
PID:2784 -
C:\Windows\SysWOW64\stbwaehvo.exeC:\Windows\system32\stbwaehvo.exe 828 "C:\Windows\SysWOW64\gznohrcma.exe"73⤵PID:2928
-
C:\Windows\SysWOW64\uergohvpa.exeC:\Windows\system32\uergohvpa.exe 808 "C:\Windows\SysWOW64\stbwaehvo.exe"74⤵PID:2708
-
C:\Windows\SysWOW64\huljwhswb.exeC:\Windows\system32\huljwhswb.exe 832 "C:\Windows\SysWOW64\uergohvpa.exe"75⤵PID:2652
-
C:\Windows\SysWOW64\uwrzitfgo.exeC:\Windows\system32\uwrzitfgo.exe 812 "C:\Windows\SysWOW64\huljwhswb.exe"76⤵PID:1852
-
C:\Windows\SysWOW64\hnmbqccnh.exeC:\Windows\system32\hnmbqccnh.exe 836 "C:\Windows\SysWOW64\uwrzitfgo.exe"77⤵PID:2880
-
C:\Windows\SysWOW64\uaerwxjaw.exeC:\Windows\system32\uaerwxjaw.exe 820 "C:\Windows\SysWOW64\hnmbqccnh.exe"78⤵PID:1752
-
C:\Windows\SysWOW64\doeoufoxv.exeC:\Windows\system32\doeoufoxv.exe 824 "C:\Windows\SysWOW64\uaerwxjaw.exe"79⤵PID:2768
-
C:\Windows\SysWOW64\tafjystjc.exeC:\Windows\system32\tafjystjc.exe 852 "C:\Windows\SysWOW64\doeoufoxv.exe"80⤵PID:1132
-
C:\Windows\SysWOW64\ddculvzlw.exeC:\Windows\system32\ddculvzlw.exe 856 "C:\Windows\SysWOW64\tafjystjc.exe"81⤵PID:3068
-
C:\Windows\SysWOW64\qtxxuvfsp.exeC:\Windows\system32\qtxxuvfsp.exe 840 "C:\Windows\SysWOW64\ddculvzlw.exe"82⤵PID:2136
-
C:\Windows\SysWOW64\dvdefijcd.exeC:\Windows\system32\dvdefijcd.exe 860 "C:\Windows\SysWOW64\qtxxuvfsp.exe"83⤵PID:444
-
C:\Windows\SysWOW64\ngspalpwp.exeC:\Windows\system32\ngspalpwp.exe 844 "C:\Windows\SysWOW64\dvdefijcd.exe"84⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\axnrjlvdq.exeC:\Windows\system32\axnrjlvdq.exe 872 "C:\Windows\SysWOW64\ngspalpwp.exe"85⤵PID:2112
-
C:\Windows\SysWOW64\nnqustbkr.exeC:\Windows\system32\nnqustbkr.exe 848 "C:\Windows\SysWOW64\axnrjlvdq.exe"86⤵PID:280
-
C:\Windows\SysWOW64\wyfefwhme.exeC:\Windows\system32\wyfefwhme.exe 884 "C:\Windows\SysWOW64\nnqustbkr.exe"87⤵PID:1780
-
C:\Windows\SysWOW64\joahnfmtw.exeC:\Windows\system32\joahnfmtw.exe 864 "C:\Windows\SysWOW64\wyfefwhme.exe"88⤵PID:1704
-
C:\Windows\SysWOW64\wndkwfkbx.exeC:\Windows\system32\wndkwfkbx.exe 892 "C:\Windows\SysWOW64\joahnfmtw.exe"89⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\SysWOW64\gpsuriydk.exeC:\Windows\system32\gpsuriydk.exe 868 "C:\Windows\SysWOW64\wndkwfkbx.exe"90⤵
- Drops file in System32 directory
PID:1740 -
C:\Windows\SysWOW64\tonxaqwkl.exeC:\Windows\system32\tonxaqwkl.exe 888 "C:\Windows\SysWOW64\gpsuriydk.exe"91⤵PID:2772
-
C:\Windows\SysWOW64\geisjybrm.exeC:\Windows\system32\geisjybrm.exe 876 "C:\Windows\SysWOW64\tonxaqwkl.exe"92⤵PID:2944
-
C:\Windows\SysWOW64\qpxcwtily.exeC:\Windows\system32\qpxcwtily.exe 880 "C:\Windows\SysWOW64\geisjybrm.exe"93⤵PID:2672
-
C:\Windows\SysWOW64\dfafebnaz.exeC:\Windows\system32\dfafebnaz.exe 900 "C:\Windows\SysWOW64\qpxcwtily.exe"94⤵PID:2780
-
C:\Windows\SysWOW64\qwvhvktis.exeC:\Windows\system32\qwvhvktis.exe 908 "C:\Windows\SysWOW64\dfafebnaz.exe"95⤵PID:2528
-
C:\Windows\SysWOW64\duqkekqpt.exeC:\Windows\system32\duqkekqpt.exe 896 "C:\Windows\SysWOW64\qwvhvktis.exe"96⤵PID:2680
-
C:\Windows\SysWOW64\qltnmswwu.exeC:\Windows\system32\qltnmswwu.exe 904 "C:\Windows\SysWOW64\duqkekqpt.exe"97⤵PID:1920
-
C:\Windows\SysWOW64\zztkczjst.exeC:\Windows\system32\zztkczjst.exe 912 "C:\Windows\SysWOW64\qltnmswwu.exe"98⤵PID:820
-
C:\Windows\SysWOW64\mponlipau.exeC:\Windows\system32\mponlipau.exe 924 "C:\Windows\SysWOW64\zztkczjst.exe"99⤵PID:1916
-
C:\Windows\SysWOW64\zojptimhn.exeC:\Windows\system32\zojptimhn.exe 916 "C:\Windows\SysWOW64\mponlipau.exe"100⤵PID:2960
-
C:\Windows\SysWOW64\memscqson.exeC:\Windows\system32\memscqson.exe 936 "C:\Windows\SysWOW64\zojptimhn.exe"101⤵PID:2596
-
C:\Windows\SysWOW64\zgsavuwyb.exeC:\Windows\system32\zgsavuwyb.exe 920 "C:\Windows\SysWOW64\memscqson.exe"102⤵
- System Location Discovery: System Language Discovery
PID:688 -
C:\Windows\SysWOW64\ijhkjxkan.exeC:\Windows\system32\ijhkjxkan.exe 940 "C:\Windows\SysWOW64\zgsavuwyb.exe"103⤵PID:2412
-
C:\Windows\SysWOW64\vhcnrgiho.exeC:\Windows\system32\vhcnrgiho.exe 928 "C:\Windows\SysWOW64\ijhkjxkan.exe"104⤵
- Drops file in System32 directory
PID:276 -
C:\Windows\SysWOW64\iyfqaoooh.exeC:\Windows\system32\iyfqaoooh.exe 932 "C:\Windows\SysWOW64\vhcnrgiho.exe"105⤵PID:492
-
C:\Windows\SysWOW64\vwzsiotvi.exeC:\Windows\system32\vwzsiotvi.exe 944 "C:\Windows\SysWOW64\iyfqaoooh.exe"106⤵PID:2420
-
C:\Windows\SysWOW64\inuvrwzdj.exeC:\Windows\system32\inuvrwzdj.exe 948 "C:\Windows\SysWOW64\vwzsiotvi.exe"107⤵PID:1276
-
C:\Windows\SysWOW64\sbvkpeezi.exeC:\Windows\system32\sbvkpeezi.exe 952 "C:\Windows\SysWOW64\inuvrwzdj.exe"108⤵PID:2964
-
C:\Windows\SysWOW64\fsqnymjgj.exeC:\Windows\system32\fsqnymjgj.exe 956 "C:\Windows\SysWOW64\sbvkpeezi.exe"109⤵PID:1324
-
C:\Windows\SysWOW64\sqtqgmpnc.exeC:\Windows\system32\sqtqgmpnc.exe 960 "C:\Windows\SysWOW64\fsqnymjgj.exe"110⤵PID:2352
-
C:\Windows\SysWOW64\fhnspuudc.exeC:\Windows\system32\fhnspuudc.exe 972 "C:\Windows\SysWOW64\sqtqgmpnc.exe"111⤵PID:1396
-
C:\Windows\SysWOW64\rjtiazzeq.exeC:\Windows\system32\rjtiazzeq.exe 968 "C:\Windows\SysWOW64\fhnspuudc.exe"112⤵PID:2716
-
C:\Windows\SysWOW64\bljswcfgd.exeC:\Windows\system32\bljswcfgd.exe 980 "C:\Windows\SysWOW64\rjtiazzeq.exe"113⤵PID:2580
-
C:\Windows\SysWOW64\rqrnspcbk.exeC:\Windows\system32\rqrnspcbk.exe 964 "C:\Windows\SysWOW64\bljswcfgd.exe"114⤵PID:2932
-
C:\Windows\SysWOW64\bagynsive.exeC:\Windows\system32\bagynsive.exe 988 "C:\Windows\SysWOW64\rqrnspcbk.exe"115⤵PID:2572
-
C:\Windows\SysWOW64\orbbvsocx.exeC:\Windows\system32\orbbvsocx.exe 976 "C:\Windows\SysWOW64\bagynsive.exe"116⤵PID:2620
-
C:\Windows\SysWOW64\ybrljvcek.exeC:\Windows\system32\ybrljvcek.exe 984 "C:\Windows\SysWOW64\orbbvsocx.exe"117⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Windows\SysWOW64\lstgrdall.exeC:\Windows\system32\lstgrdall.exe 992 "C:\Windows\SysWOW64\ybrljvcek.exe"118⤵PID:2236
-
C:\Windows\SysWOW64\yqoiamfsl.exeC:\Windows\system32\yqoiamfsl.exe 1008 "C:\Windows\SysWOW64\lstgrdall.exe"119⤵PID:1796
-
C:\Windows\SysWOW64\kkuytqjcz.exeC:\Windows\system32\kkuytqjcz.exe 996 "C:\Windows\SysWOW64\yqoiamfsl.exe"120⤵PID:2876
-
C:\Windows\SysWOW64\uvkigtqwl.exeC:\Windows\system32\uvkigtqwl.exe 1000 "C:\Windows\SysWOW64\kkuytqjcz.exe"121⤵PID:2520
-
C:\Windows\SysWOW64\hlmlpbvde.exeC:\Windows\system32\hlmlpbvde.exe 1004 "C:\Windows\SysWOW64\uvkigtqwl.exe"122⤵PID:1784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-