pony | 694fef7d7c2f0a5fdf9110caac07b01c24be8653faed1d670e3a53679ccd4d26

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
Size

1.7MB
MD5

d5fcd73cabc2e7ce6d86d7d3ab7dd2c2
SHA1

d8b1aa82b23d20e3164c5471e86c3e31646ee2bc
SHA256

694fef7d7c2f0a5fdf9110caac07b01c24be8653faed1d670e3a53679ccd4d26
SHA512

894446e782a21f6c9c8f6879e0fdcaac380152a7d4801449ac853de4f56c2a66fac1c4cb6f00f8a71547beae0524e15bdba846cee45a101b51ffeee308088f67
SSDEEP

49152:JCS45lWOPX9r3FI+QPMb1Per45dcXRMR8EVLZwj:JCzpPpF1H5er45eBKr

Score

10^/10

pony credential_access discovery persistence rat spyware stealer upx

Malware Config

Signatures

Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 64 IoCs

pid	Process
2980	dwme.exe
2508	dwme.exe
2036	D4amH6sWJfLgZh.exe
2840	dwme.exe
2572	QJ6dWK8fR9TqUeI.exe
2364	dwme.exe
2056	dwme.exe
2020	pgRZqhYXwUeOtPy.exe
2868	dwme.exe
1832	dwme.exe
2936	B3pnG4aQHsKfLgZ.exe
2212	dwme.exe
468	dwme.exe
1352	WUCelIBrzNx1v2b.exe
1660	dwme.exe
1592	dwme.exe
836	k1ivD3onFaHsJd.exe
992	dwme.exe
1520	dwme.exe
1596	ApnG5aQH6W7R9Tq.exe
1328	dwme.exe
2652	dwme.exe
2684	KmH5sQJ7dKgZhXj.exe
2836	dwme.exe
2716	dwme.exe
2840	zaQH6sWK7E9TqYw.exe
1140	dwme.exe
1756	dwme.exe
760	eK8fRZ9hTwUeIrP.exe
2604	dwme.exe
348	dwme.exe
1344	LrlOBtxP0c1v3n4.exe
2260	dwme.exe
2388	dwme.exe
1308	jPNyxA1uv2b3m5Q.exe
304	dwme.exe
1748	dwme.exe
468	DycS1ivD3n4m5W7.exe
1788	dwme.exe
1656	dwme.exe
372	RQH6dWK7fLgXjC.exe
1692	dwme.exe
1932	dwme.exe
1528	ysQJ7dEK8R9YwU.exe
1520	dwme.exe
2480	dwme.exe
2300	wQH6sWK7fLgZj.exe
2652	dwme.exe
2588	dwme.exe
2600	shTXwjUCeIrPyAu.exe
2716	dwme.exe
2756	dwme.exe
2744	lYCwkUVrlBx0c1v.exe
832	dwme.exe
1260	dwme.exe
1632	BTXqjUCekBzNx0v.exe
2724	dwme.exe
2112	dwme.exe
2940	yXwkUVelOtPyAiD.exe
2388	dwme.exe
2432	dwme.exe
2632	LIVrzONtx0c2b3n.exe
1272	dwme.exe
940	dwme.exe

Loads dropped DLL 64 IoCs

pid	Process
1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
2036	D4amH6sWJfLgZh.exe
2036	D4amH6sWJfLgZh.exe
2036	D4amH6sWJfLgZh.exe
2036	D4amH6sWJfLgZh.exe
2572	QJ6dWK8fR9TqUeI.exe
2572	QJ6dWK8fR9TqUeI.exe
2572	QJ6dWK8fR9TqUeI.exe
2572	QJ6dWK8fR9TqUeI.exe
2572	QJ6dWK8fR9TqUeI.exe
2572	QJ6dWK8fR9TqUeI.exe
2020	pgRZqhYXwUeOtPy.exe
2020	pgRZqhYXwUeOtPy.exe
2020	pgRZqhYXwUeOtPy.exe
2020	pgRZqhYXwUeOtPy.exe
2020	pgRZqhYXwUeOtPy.exe
2020	pgRZqhYXwUeOtPy.exe
2936	B3pnG4aQHsKfLgZ.exe
2936	B3pnG4aQHsKfLgZ.exe
2936	B3pnG4aQHsKfLgZ.exe
2936	B3pnG4aQHsKfLgZ.exe
2936	B3pnG4aQHsKfLgZ.exe
2936	B3pnG4aQHsKfLgZ.exe
1352	WUCelIBrzNx1v2b.exe
1352	WUCelIBrzNx1v2b.exe
1352	WUCelIBrzNx1v2b.exe
1352	WUCelIBrzNx1v2b.exe
1352	WUCelIBrzNx1v2b.exe
1352	WUCelIBrzNx1v2b.exe
836	k1ivD3onFaHsJd.exe
836	k1ivD3onFaHsJd.exe
836	k1ivD3onFaHsJd.exe
836	k1ivD3onFaHsJd.exe
836	k1ivD3onFaHsJd.exe
836	k1ivD3onFaHsJd.exe
1596	ApnG5aQH6W7R9Tq.exe
1596	ApnG5aQH6W7R9Tq.exe
1596	ApnG5aQH6W7R9Tq.exe
1596	ApnG5aQH6W7R9Tq.exe
1596	ApnG5aQH6W7R9Tq.exe
1596	ApnG5aQH6W7R9Tq.exe
2684	KmH5sQJ7dKgZhXj.exe
2684	KmH5sQJ7dKgZhXj.exe
2684	KmH5sQJ7dKgZhXj.exe
2684	KmH5sQJ7dKgZhXj.exe
2684	KmH5sQJ7dKgZhXj.exe
2684	KmH5sQJ7dKgZhXj.exe
2840	zaQH6sWK7E9TqYw.exe
2840	zaQH6sWK7E9TqYw.exe
2840	zaQH6sWK7E9TqYw.exe
2840	zaQH6sWK7E9TqYw.exe
2840	zaQH6sWK7E9TqYw.exe
2840	zaQH6sWK7E9TqYw.exe
760	eK8fRZ9hTwUeIrP.exe
760	eK8fRZ9hTwUeIrP.exe
760	eK8fRZ9hTwUeIrP.exe
760	eK8fRZ9hTwUeIrP.exe
760	eK8fRZ9hTwUeIrP.exe
760	eK8fRZ9hTwUeIrP.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qUCelIBrzNx1v2b = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	ObD3pnG4aHsKfLg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\edWK8fRL9TqUeIr8234A = "C:\\Windows\\system32\\jPNyxA1uv2b3m5Q.exe"	LrlOBtxP0c1v3n4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PibF3pnG5Q6W7R98234A = "C:\\Windows\\system32\\BTXqjUCekBzNx0v.exe"	lYCwkUVrlBx0c1v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PIVrzONtx0c8234A = "C:\\Windows\\system32\\RQH6dWK7fLgXjC.exe"	DycS1ivD3n4m5W7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NbF4pmG5sJdKfZ = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	BTXqjUCekBzNx0v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LJ7dEL8gRqYwUeO = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	gsQJ6dEK8R9TwUe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HuvS2ibF3n5Q6W7 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	bkIVrlONtPuSiDo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QwkUVrlOBx0c1v38234A = "C:\\Windows\\system32\\GnG4amH6sJfLgZh.exe"	fF4pmG5sQ6E8R9T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RnF4amH5sJd = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	OD2obF4pm5Q6E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b8gRZqhYXkV8234A = "C:\\Windows\\system32\\k1ivD3onFaHsJd.exe"	WUCelIBrzNx1v2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\apmG5sQJ6E8R9Tw8234A = "C:\\Windows\\system32\\CPNycA1uv2b.exe"	LIVrzONtx0c2b3n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\p4amH6sWJfLgZhC8234A = "C:\\Windows\\system32\\bkIVrlONtPuSiDo.exe"	ONycA1uvDo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bS2ibD3pn4Q6W78234A = "C:\\Windows\\system32\\S9gTXqjYCkVzNx0.exe"	pOBtzP0yc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PYCwkIVrlNx0c1b8234A = "C:\\Windows\\system32\\B3pnG4aQHsKfLgZ.exe"	pgRZqhYXwUeOtPy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vCekIVrzOtAuSiD8234A = "C:\\Windows\\system32\\ApnG5aQH6W7R9Tq.exe"	k1ivD3onFaHsJd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VwkIVrlONx0c = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	bmH5sWJ7dLgZhXk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qgTZqhYCw8234A = "C:\\Windows\\system32\\mD3onG4am6W7E.exe"	OD2obF4pm5Q6E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snF4amH5sJdLgZh = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	eK8fRZ9hTwUeIrP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ijUCekIBrOyAu = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	IG4aQH6sW7E9TqY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Y9hTXwjUClBzNx1 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	RQH6dWK7fLgXjC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZobF3pmG5Q6W8R98234A = "C:\\Windows\\system32\\iTXwjUCelBzNx1v.exe"	bkIVrlONtPuSiDo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eVelIBtzPyAuDo = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	q3pmG5aQJdKfLhX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\P5sWJ7dELgZhXkV8234A = "C:\\Windows\\system32\\BlOBtxP0ySiDoFa.exe"	QCelIBrzPyAuSoF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pelOBtzP0c1v2n48234A = "C:\\Windows\\system32\\bmH5sWJ7dLgZhXk.exe"	q3pmG5aQJdKfLhX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fmG5aQJ6dKfLhXj8234A = "C:\\Windows\\system32\\QCelIBrzPyAuSoF.exe"	mD3onG4am6W7E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SK8fRZ9hTwUeIrP8234A = "C:\\Windows\\system32\\qycA1uvD2b4m5Q6.exe"	LNtxA0ucSiDpGaH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZK8fRL9hTqUeIrO = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	LNtxA0ucSiDpGaH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yVrlONtxPuSiDoG8234A = "C:\\Windows\\system32\\zaQH6sWK7E9TqYw.exe"	KmH5sQJ7dKgZhXj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UyxA0uvS2b3n5Q6 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	zaQH6sWK7E9TqYw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OwkUVelOBz0c1 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	fF4pmG5sQ6E8R9T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xTZqjYCwkVlNx0c = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	DycS1ivD3n4m5W7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\E2ibD3pnGaHsK = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	lYCwkUVrlBx0c1v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dIBtzPNyc1v2b4m8234A = "C:\\Windows\\system32\\Q5sQJ7dEKgZhXjV.exe"	zG5aQH6dW7R9TqY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\divD2onF4m5Q7E88234A = "C:\\Windows\\system32\\pOBtzP0yc.exe"	CbF3pnG5aHdKfLg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DUCekIBrzNx0v2b8234A = "C:\\Windows\\system32\\q3pmG5aQJdKfLhX.exe"	GnG4amH6sJfLgZh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xhYCwkUVrOtPySi8234A = "C:\\Windows\\system32\\XG4amH6sW7E8T.exe"	qycA1uvD2b4m5Q6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zkIVrlONtPuSiDo8234A = "C:\\Windows\\system32\\IG4aQH6sW7E9TqY.exe"	u4pmH5sQJdKgZhX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\P6sWK7fELgZjCk = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	BlOBtxP0ySiDoFa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kEK8gRZ9hXjVlB = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	jPNyxA1uv2b3m5Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IivD2onF4 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	iTXwjUCelBzNx1v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KUVelIBtzNc1v2b8234A = "C:\\Windows\\system32\\u4pmH5sQJdKgZhX.exe"	ObD3pnG4aHsKfLg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KIBrzONyx0v2b = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	vaQH6sWK7E9TqYw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\awjUVelIBzNc1 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	CQJ6dWK8fLhXjCk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xqjYCwkIVlNx0c18234A = "C:\\Windows\\system32\\ObD3pnG4aHsKfLg.exe"	VRZ9hYXwjVlBzNc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EqjYCwkIVlNx0 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	VRZ9hYXwjVlBzNc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IrzONyxA0v2b3n58234A = "C:\\Windows\\system32\\CQJ6dWK8fLhXjCk.exe"	hCwkUVrlOtPySiD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IqjYCekIVzNx0c28234A = "C:\\Windows\\system32\\CbF3pnG5aHdKfLg.exe"	OdEL8gRZqY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OuvD2obF4m5Q68234A = "C:\\Windows\\system32\\VRZ9hYXwjVlBzNc.exe"	S9gTXqjYCkVzNx0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZYCekIVrzNx0 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	GnG4amH6sJfLgZh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bbF4pmG5sJdKfZh = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	yONyxA0uv2b3n5Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UXwjUCelIrPyAu = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	S9gTXqjYCkVzNx0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qUVrlOBtx0c1 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	Q5sQJ7dEKgZhXjV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dzONyxA0uSiFpGa8234A = "C:\\Windows\\system32\\QJ6dWK8fR9TqUeI.exe"	D4amH6sWJfLgZh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cCelIBrzPyAu = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	ApnG5aQH6W7R9Tq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IH6sWK7fE9TqYwI8234A = "C:\\Windows\\system32\\CrzONtxA0c2b3n4.exe"	CPNycA1uv2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QwkIVrlONx0c1b38234A = "C:\\Windows\\system32\\wQH6sWK7fLgZj.exe"	ysQJ7dEK8R9YwU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OwkUVrlOBx0c1v3 = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	ysQJ7dEK8R9YwU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\l4pmG5sQJdKfZhX8234A = "C:\\Windows\\system32\\ONycA1uvDo.exe"	CrzONtxA0c2b3n4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T9gTZqjYC = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	OdEL8gRZqY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TWK7fEL9gZjCkVl8234A = "C:\\Windows\\system32\\LNtxA0ucSiDpGaH.exe"	HVelOBtzPyAiDoF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\nsQJ7dEK8R9YwUe = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	WUCelIBrzNx1v2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OqjYCwkIVl = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	k1ivD3onFaHsJd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FxA1uvS2oFpGaJd8234A = "C:\\Windows\\system32\\eK8fRZ9hTwUeIrP.exe"	zaQH6sWK7E9TqYw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\C2onF4pmHsJdKg = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	shTXwjUCeIrPyAu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 54 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hCwkUVrlOtPySiD.exe	iTXwjUCelBzNx1v.exe
File created	C:\Windows\SysWOW64\RQH6dWK7fLgXjC.exe	DycS1ivD3n4m5W7.exe
File created	C:\Windows\SysWOW64\ONycA1uvDo.exe	CrzONtxA0c2b3n4.exe
File created	C:\Windows\SysWOW64\qycA1uvD2b4m5Q6.exe	LNtxA0ucSiDpGaH.exe
File created	C:\Windows\SysWOW64\pgRZqhYXwUeOtPy.exe	QJ6dWK8fR9TqUeI.exe
File created	C:\Windows\SysWOW64\k1ivD3onFaHsJd.exe	WUCelIBrzNx1v2b.exe
File created	C:\Windows\SysWOW64\jPNyxA1uv2b3m5Q.exe	LrlOBtxP0c1v3n4.exe
File created	C:\Windows\SysWOW64\bkIVrlONtPuSiDo.exe	ONycA1uvDo.exe
File created	C:\Windows\SysWOW64\CQJ6dWK8fLhXjCk.exe	hCwkUVrlOtPySiD.exe
File created	C:\Windows\SysWOW64\QJ6dWK8fR9TqUeI.exe	D4amH6sWJfLgZh.exe
File created	C:\Windows\SysWOW64\ysQJ7dEK8R9YwU.exe	RQH6dWK7fLgXjC.exe
File created	C:\Windows\SysWOW64\S9gTXqjYCkVzNx0.exe	pOBtzP0yc.exe
File created	C:\Windows\SysWOW64\KmH5sQJ7dKgZhXj.exe	ApnG5aQH6W7R9Tq.exe
File created	C:\Windows\SysWOW64\yXwkUVelOtPyAiD.exe	BTXqjUCekBzNx0v.exe
File created	C:\Windows\SysWOW64\mD3onG4am6W7E.exe	OD2obF4pm5Q6E.exe
File created	C:\Windows\SysWOW64\XG4amH6sW7E8T.exe	qycA1uvD2b4m5Q6.exe
File created	C:\Windows\SysWOW64\B3pnG4aQHsKfLgZ.exe	pgRZqhYXwUeOtPy.exe
File created	C:\Windows\SysWOW64\CbF3pnG5aHdKfLg.exe	OdEL8gRZqY.exe
File created	C:\Windows\SysWOW64\VRZ9hYXwjVlBzNc.exe	S9gTXqjYCkVzNx0.exe
File created	C:\Windows\SysWOW64\IG4aQH6sW7E9TqY.exe	u4pmH5sQJdKgZhX.exe
File created	C:\Windows\SysWOW64\eD3onG4am6W7E8.exe	gsQJ6dEK8R9TwUe.exe
File created	C:\Windows\SysWOW64\pOBtzP0yc.exe	CbF3pnG5aHdKfLg.exe
File created	C:\Windows\SysWOW64\LNtxA0ucSiDpGaH.exe	HVelOBtzPyAiDoF.exe
File created	C:\Windows\SysWOW64\LrlOBtxP0c1v3n4.exe	eK8fRZ9hTwUeIrP.exe
File created	C:\Windows\SysWOW64\DycS1ivD3n4m5W7.exe	jPNyxA1uv2b3m5Q.exe
File created	C:\Windows\SysWOW64\fF4pmG5sQ6E8R9T.exe	IG4aQH6sW7E9TqY.exe
File created	C:\Windows\SysWOW64\GnG4amH6sJfLgZh.exe	fF4pmG5sQ6E8R9T.exe
File created	C:\Windows\SysWOW64\Q5sQJ7dEKgZhXjV.exe	zG5aQH6dW7R9TqY.exe
File created	C:\Windows\SysWOW64\e5aQJ6dWKfLhXj.exe	XG4amH6sW7E8T.exe
File created	C:\Windows\SysWOW64\q3pmG5aQJdKfLhX.exe	GnG4amH6sJfLgZh.exe
File created	C:\Windows\SysWOW64\QCelIBrzPyAuSoF.exe	mD3onG4am6W7E.exe
File created	C:\Windows\SysWOW64\ApnG5aQH6W7R9Tq.exe	k1ivD3onFaHsJd.exe
File created	C:\Windows\SysWOW64\zaQH6sWK7E9TqYw.exe	KmH5sQJ7dKgZhXj.exe
File created	C:\Windows\SysWOW64\BTXqjUCekBzNx0v.exe	lYCwkUVrlBx0c1v.exe
File created	C:\Windows\SysWOW64\BlOBtxP0ySiDoFa.exe	QCelIBrzPyAuSoF.exe
File created	C:\Windows\SysWOW64\iTXwjUCelBzNx1v.exe	bkIVrlONtPuSiDo.exe
File created	C:\Windows\SysWOW64\vaQH6sWK7E9TqYw.exe	Q5sQJ7dEKgZhXjV.exe
File created	C:\Windows\SysWOW64\gsQJ6dEK8R9TwUe.exe	vaQH6sWK7E9TqYw.exe
File created	C:\Windows\SysWOW64\CPNycA1uv2b.exe	LIVrzONtx0c2b3n.exe
File created	C:\Windows\SysWOW64\CrzONtxA0c2b3n4.exe	CPNycA1uv2b.exe
File created	C:\Windows\SysWOW64\OD2obF4pm5Q6E.exe	eD3onG4am6W7E8.exe
File created	C:\Windows\SysWOW64\HVelOBtzPyAiDoF.exe	yONyxA0uv2b3n5Q.exe
File created	C:\Windows\SysWOW64\WUCelIBrzNx1v2b.exe	B3pnG4aQHsKfLgZ.exe
File created	C:\Windows\SysWOW64\shTXwjUCeIrPyAu.exe	wQH6sWK7fLgZj.exe
File created	C:\Windows\SysWOW64\D4amH6sWJfLgZh.exe	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zG5aQH6dW7R9TqY.exe	bmH5sWJ7dLgZhXk.exe
File created	C:\Windows\SysWOW64\LIVrzONtx0c2b3n.exe	yXwkUVelOtPyAiD.exe
File created	C:\Windows\SysWOW64\OdEL8gRZqY.exe	CQJ6dWK8fLhXjCk.exe
File created	C:\Windows\SysWOW64\ObD3pnG4aHsKfLg.exe	VRZ9hYXwjVlBzNc.exe
File created	C:\Windows\SysWOW64\bmH5sWJ7dLgZhXk.exe	q3pmG5aQJdKfLhX.exe
File created	C:\Windows\SysWOW64\eK8fRZ9hTwUeIrP.exe	zaQH6sWK7E9TqYw.exe
File created	C:\Windows\SysWOW64\wQH6sWK7fLgZj.exe	ysQJ7dEK8R9YwU.exe
File created	C:\Windows\SysWOW64\lYCwkUVrlBx0c1v.exe	shTXwjUCeIrPyAu.exe
File created	C:\Windows\SysWOW64\u4pmH5sQJdKgZhX.exe	ObD3pnG4aHsKfLg.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1636-2-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/1636-30-0x0000000000400000-0x00000000008B3000-memory.dmp	upx
behavioral1/memory/1636-33-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/2036-54-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/2572-89-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/2020-122-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/2936-156-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/1352-188-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/836-210-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/1596-230-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/2684-251-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/2840-272-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/760-294-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/1344-314-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/1308-336-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/468-356-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/372-377-0x0000000000400000-0x00000000008B6000-memory.dmp	upx
behavioral1/memory/1528-398-0x0000000000400000-0x00000000008B6000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrzONtxA0c2b3n4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jPNyxA1uv2b3m5Q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bkIVrlONtPuSiDo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B3pnG4aQHsKfLgZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mD3onG4am6W7E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RQH6dWK7fLgXjC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIVrzONtx0c2b3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OdEL8gRZqY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lYCwkUVrlBx0c1v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LrlOBtxP0c1v3n4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CQJ6dWK8fLhXjCk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XG4amH6sW7E8T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HVelOBtzPyAiDoF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1ivD3onFaHsJd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QCelIBrzPyAuSoF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CbF3pnG5aHdKfLg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApnG5aQH6W7R9Tq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysQJ7dEK8R9YwU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shTXwjUCeIrPyAu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gsQJ6dEK8R9TwUe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eK8fRZ9hTwUeIrP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S9gTXqjYCkVzNx0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Q5sQJ7dEKgZhXjV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wQH6sWK7fLgZj.exe

Suspicious use of SetWindowsHookEx 54 IoCs

pid	Process
1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
2036	D4amH6sWJfLgZh.exe
2572	QJ6dWK8fR9TqUeI.exe
2020	pgRZqhYXwUeOtPy.exe
2936	B3pnG4aQHsKfLgZ.exe
1352	WUCelIBrzNx1v2b.exe
836	k1ivD3onFaHsJd.exe
1596	ApnG5aQH6W7R9Tq.exe
2684	KmH5sQJ7dKgZhXj.exe
2840	zaQH6sWK7E9TqYw.exe
760	eK8fRZ9hTwUeIrP.exe
1344	LrlOBtxP0c1v3n4.exe
1308	jPNyxA1uv2b3m5Q.exe
468	DycS1ivD3n4m5W7.exe
372	RQH6dWK7fLgXjC.exe
1528	ysQJ7dEK8R9YwU.exe
2300	wQH6sWK7fLgZj.exe
2600	shTXwjUCeIrPyAu.exe
2744	lYCwkUVrlBx0c1v.exe
1632	BTXqjUCekBzNx0v.exe
2940	yXwkUVelOtPyAiD.exe
2632	LIVrzONtx0c2b3n.exe
2420	CPNycA1uv2b.exe
3036	CrzONtxA0c2b3n4.exe
1912	ONycA1uvDo.exe
2508	bkIVrlONtPuSiDo.exe
2024	iTXwjUCelBzNx1v.exe
2752	hCwkUVrlOtPySiD.exe
2908	CQJ6dWK8fLhXjCk.exe
2144	OdEL8gRZqY.exe
2220	CbF3pnG5aHdKfLg.exe
2192	pOBtzP0yc.exe
2008	S9gTXqjYCkVzNx0.exe
2036	VRZ9hYXwjVlBzNc.exe
984	ObD3pnG4aHsKfLg.exe
1084	u4pmH5sQJdKgZhX.exe
2136	IG4aQH6sW7E9TqY.exe
664	fF4pmG5sQ6E8R9T.exe
2936	GnG4amH6sJfLgZh.exe
1792	q3pmG5aQJdKfLhX.exe
2328	bmH5sWJ7dLgZhXk.exe
2480	zG5aQH6dW7R9TqY.exe
1360	Q5sQJ7dEKgZhXjV.exe
2944	vaQH6sWK7E9TqYw.exe
1260	gsQJ6dEK8R9TwUe.exe
448	eD3onG4am6W7E8.exe
2316	OD2obF4pm5Q6E.exe
924	mD3onG4am6W7E.exe
2100	QCelIBrzPyAuSoF.exe
2008	yONyxA0uv2b3n5Q.exe
1816	HVelOBtzPyAiDoF.exe
2284	LNtxA0ucSiDpGaH.exe
2424	qycA1uvD2b4m5Q6.exe
840	XG4amH6sW7E8T.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2980	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2980	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2980	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2980	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2508	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2508	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2508	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2508	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2036	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	33
PID 1636 wrote to memory of 2036	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	33
PID 1636 wrote to memory of 2036	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	33
PID 1636 wrote to memory of 2036	1636	d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2840	2036	D4amH6sWJfLgZh.exe	34
PID 2036 wrote to memory of 2840	2036	D4amH6sWJfLgZh.exe	34
PID 2036 wrote to memory of 2840	2036	D4amH6sWJfLgZh.exe	34
PID 2036 wrote to memory of 2840	2036	D4amH6sWJfLgZh.exe	34
PID 2036 wrote to memory of 2572	2036	D4amH6sWJfLgZh.exe	35
PID 2036 wrote to memory of 2572	2036	D4amH6sWJfLgZh.exe	35
PID 2036 wrote to memory of 2572	2036	D4amH6sWJfLgZh.exe	35
PID 2036 wrote to memory of 2572	2036	D4amH6sWJfLgZh.exe	35
PID 2572 wrote to memory of 2364	2572	QJ6dWK8fR9TqUeI.exe	36
PID 2572 wrote to memory of 2364	2572	QJ6dWK8fR9TqUeI.exe	36
PID 2572 wrote to memory of 2364	2572	QJ6dWK8fR9TqUeI.exe	36
PID 2572 wrote to memory of 2364	2572	QJ6dWK8fR9TqUeI.exe	36
PID 2572 wrote to memory of 2056	2572	QJ6dWK8fR9TqUeI.exe	37
PID 2572 wrote to memory of 2056	2572	QJ6dWK8fR9TqUeI.exe	37
PID 2572 wrote to memory of 2056	2572	QJ6dWK8fR9TqUeI.exe	37
PID 2572 wrote to memory of 2056	2572	QJ6dWK8fR9TqUeI.exe	37
PID 2572 wrote to memory of 2020	2572	QJ6dWK8fR9TqUeI.exe	38
PID 2572 wrote to memory of 2020	2572	QJ6dWK8fR9TqUeI.exe	38
PID 2572 wrote to memory of 2020	2572	QJ6dWK8fR9TqUeI.exe	38
PID 2572 wrote to memory of 2020	2572	QJ6dWK8fR9TqUeI.exe	38
PID 2020 wrote to memory of 2868	2020	pgRZqhYXwUeOtPy.exe	39
PID 2020 wrote to memory of 2868	2020	pgRZqhYXwUeOtPy.exe	39
PID 2020 wrote to memory of 2868	2020	pgRZqhYXwUeOtPy.exe	39
PID 2020 wrote to memory of 2868	2020	pgRZqhYXwUeOtPy.exe	39
PID 2020 wrote to memory of 1832	2020	pgRZqhYXwUeOtPy.exe	40
PID 2020 wrote to memory of 1832	2020	pgRZqhYXwUeOtPy.exe	40
PID 2020 wrote to memory of 1832	2020	pgRZqhYXwUeOtPy.exe	40
PID 2020 wrote to memory of 1832	2020	pgRZqhYXwUeOtPy.exe	40
PID 2020 wrote to memory of 2936	2020	pgRZqhYXwUeOtPy.exe	41
PID 2020 wrote to memory of 2936	2020	pgRZqhYXwUeOtPy.exe	41
PID 2020 wrote to memory of 2936	2020	pgRZqhYXwUeOtPy.exe	41
PID 2020 wrote to memory of 2936	2020	pgRZqhYXwUeOtPy.exe	41
PID 2936 wrote to memory of 2212	2936	B3pnG4aQHsKfLgZ.exe	42
PID 2936 wrote to memory of 2212	2936	B3pnG4aQHsKfLgZ.exe	42
PID 2936 wrote to memory of 2212	2936	B3pnG4aQHsKfLgZ.exe	42
PID 2936 wrote to memory of 2212	2936	B3pnG4aQHsKfLgZ.exe	42
PID 2936 wrote to memory of 468	2936	B3pnG4aQHsKfLgZ.exe	43
PID 2936 wrote to memory of 468	2936	B3pnG4aQHsKfLgZ.exe	43
PID 2936 wrote to memory of 468	2936	B3pnG4aQHsKfLgZ.exe	43
PID 2936 wrote to memory of 468	2936	B3pnG4aQHsKfLgZ.exe	43
PID 2936 wrote to memory of 1352	2936	B3pnG4aQHsKfLgZ.exe	44
PID 2936 wrote to memory of 1352	2936	B3pnG4aQHsKfLgZ.exe	44
PID 2936 wrote to memory of 1352	2936	B3pnG4aQHsKfLgZ.exe	44
PID 2936 wrote to memory of 1352	2936	B3pnG4aQHsKfLgZ.exe	44
PID 1352 wrote to memory of 1660	1352	WUCelIBrzNx1v2b.exe	45
PID 1352 wrote to memory of 1660	1352	WUCelIBrzNx1v2b.exe	45
PID 1352 wrote to memory of 1660	1352	WUCelIBrzNx1v2b.exe	45
PID 1352 wrote to memory of 1660	1352	WUCelIBrzNx1v2b.exe	45
PID 1352 wrote to memory of 1592	1352	WUCelIBrzNx1v2b.exe	46
PID 1352 wrote to memory of 1592	1352	WUCelIBrzNx1v2b.exe	46
PID 1352 wrote to memory of 1592	1352	WUCelIBrzNx1v2b.exe	46
PID 1352 wrote to memory of 1592	1352	WUCelIBrzNx1v2b.exe	46

C:\Users\Admin\AppData\Local\Temp\d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\dwme.exe
  "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\AppData\Roaming\dwme.exe
  C:\Users\Admin\AppData\Roaming\dwme.exe auto
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\SysWOW64\D4amH6sWJfLgZh.exe
  C:\Windows\system32\D4amH6sWJfLgZh.exe 5985C:\Users\Admin\AppData\Local\Temp\d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Roaming\dwme.exe
    C:\Users\Admin\AppData\Roaming\dwme.exe auto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2840
- - C:\Windows\SysWOW64\QJ6dWK8fR9TqUeI.exe
    C:\Windows\system32\QJ6dWK8fR9TqUeI.exe 5985C:\Windows\SysWOW64\D4amH6sWJfLgZh.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\dwme.exe
      "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
      4⤵
      Executes dropped EXE
      PID:2364
  - - C:\Users\Admin\AppData\Roaming\dwme.exe
      C:\Users\Admin\AppData\Roaming\dwme.exe auto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2056
  - - C:\Windows\SysWOW64\pgRZqhYXwUeOtPy.exe
      C:\Windows\system32\pgRZqhYXwUeOtPy.exe 5985C:\Windows\SysWOW64\QJ6dWK8fR9TqUeI.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        5⤵
        Executes dropped EXE
        
        PID:2868
    - - C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        5⤵
        Executes dropped EXE
        
        PID:1832
    - - C:\Windows\SysWOW64\B3pnG4aQHsKfLgZ.exe
        
        C:\Windows\system32\B3pnG4aQHsKfLgZ.exe 5985C:\Windows\SysWOW64\pgRZqhYXwUeOtPy.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        6⤵
        Executes dropped EXE
        
        PID:2212
      - C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        6⤵
        Executes dropped EXE
        
        PID:468
      - C:\Windows\SysWOW64\WUCelIBrzNx1v2b.exe
        
        C:\Windows\system32\WUCelIBrzNx1v2b.exe 5985C:\Windows\SysWOW64\B3pnG4aQHsKfLgZ.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        7⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        7⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\k1ivD3onFaHsJd.exe
        
        C:\Windows\system32\k1ivD3onFaHsJd.exe 5985C:\Windows\SysWOW64\WUCelIBrzNx1v2b.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        8⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        8⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\ApnG5aQH6W7R9Tq.exe
        
        C:\Windows\system32\ApnG5aQH6W7R9Tq.exe 5985C:\Windows\SysWOW64\k1ivD3onFaHsJd.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        9⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\KmH5sQJ7dKgZhXj.exe
        
        C:\Windows\system32\KmH5sQJ7dKgZhXj.exe 5985C:\Windows\SysWOW64\ApnG5aQH6W7R9Tq.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        10⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        10⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\zaQH6sWK7E9TqYw.exe
        
        C:\Windows\system32\zaQH6sWK7E9TqYw.exe 5985C:\Windows\SysWOW64\KmH5sQJ7dKgZhXj.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        11⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        C:\Windows\SysWOW64\eK8fRZ9hTwUeIrP.exe
        
        C:\Windows\system32\eK8fRZ9hTwUeIrP.exe 5985C:\Windows\SysWOW64\zaQH6sWK7E9TqYw.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        12⤵
        Executes dropped EXE
        
        PID:348
        
        C:\Windows\SysWOW64\LrlOBtxP0c1v3n4.exe
        
        C:\Windows\system32\LrlOBtxP0c1v3n4.exe 5985C:\Windows\SysWOW64\eK8fRZ9hTwUeIrP.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        13⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        13⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\jPNyxA1uv2b3m5Q.exe
        
        C:\Windows\system32\jPNyxA1uv2b3m5Q.exe 5985C:\Windows\SysWOW64\LrlOBtxP0c1v3n4.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        14⤵
        Executes dropped EXE
        
        PID:304
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1748
        
        C:\Windows\SysWOW64\DycS1ivD3n4m5W7.exe
        
        C:\Windows\system32\DycS1ivD3n4m5W7.exe 5985C:\Windows\SysWOW64\jPNyxA1uv2b3m5Q.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1656
        
        C:\Windows\SysWOW64\RQH6dWK7fLgXjC.exe
        
        C:\Windows\system32\RQH6dWK7fLgXjC.exe 5985C:\Windows\SysWOW64\DycS1ivD3n4m5W7.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        16⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\ysQJ7dEK8R9YwU.exe
        
        C:\Windows\system32\ysQJ7dEK8R9YwU.exe 5985C:\Windows\SysWOW64\RQH6dWK7fLgXjC.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        17⤵
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\wQH6sWK7fLgZj.exe
        
        C:\Windows\system32\wQH6sWK7fLgZj.exe 5985C:\Windows\SysWOW64\ysQJ7dEK8R9YwU.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        18⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Windows\SysWOW64\shTXwjUCeIrPyAu.exe
        
        C:\Windows\system32\shTXwjUCeIrPyAu.exe 5985C:\Windows\SysWOW64\wQH6sWK7fLgZj.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        19⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        19⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\lYCwkUVrlBx0c1v.exe
        
        C:\Windows\system32\lYCwkUVrlBx0c1v.exe 5985C:\Windows\SysWOW64\shTXwjUCeIrPyAu.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        20⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\BTXqjUCekBzNx0v.exe
        
        C:\Windows\system32\BTXqjUCekBzNx0v.exe 5985C:\Windows\SysWOW64\lYCwkUVrlBx0c1v.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        21⤵
        Executes dropped EXE
        
        PID:2112
        
        C:\Windows\SysWOW64\yXwkUVelOtPyAiD.exe
        
        C:\Windows\system32\yXwkUVelOtPyAiD.exe 5985C:\Windows\SysWOW64\BTXqjUCekBzNx0v.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        22⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\LIVrzONtx0c2b3n.exe
        
        C:\Windows\system32\LIVrzONtx0c2b3n.exe 5985C:\Windows\SysWOW64\yXwkUVelOtPyAiD.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1272
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        23⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\CPNycA1uv2b.exe
        
        C:\Windows\system32\CPNycA1uv2b.exe 5985C:\Windows\SysWOW64\LIVrzONtx0c2b3n.exe
        23⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        24⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:980
        
        C:\Windows\SysWOW64\CrzONtxA0c2b3n4.exe
        
        C:\Windows\system32\CrzONtxA0c2b3n4.exe 5985C:\Windows\SysWOW64\CPNycA1uv2b.exe
        24⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        25⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        25⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\ONycA1uvDo.exe
        
        C:\Windows\system32\ONycA1uvDo.exe 5985C:\Windows\SysWOW64\CrzONtxA0c2b3n4.exe
        25⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        26⤵
        
        PID:496
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\bkIVrlONtPuSiDo.exe
        
        C:\Windows\system32\bkIVrlONtPuSiDo.exe 5985C:\Windows\SysWOW64\ONycA1uvDo.exe
        26⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        27⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\iTXwjUCelBzNx1v.exe
        
        C:\Windows\system32\iTXwjUCelBzNx1v.exe 5985C:\Windows\SysWOW64\bkIVrlONtPuSiDo.exe
        27⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        28⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Windows\SysWOW64\hCwkUVrlOtPySiD.exe
        
        C:\Windows\system32\hCwkUVrlOtPySiD.exe 5985C:\Windows\SysWOW64\iTXwjUCelBzNx1v.exe
        28⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        29⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        29⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\CQJ6dWK8fLhXjCk.exe
        
        C:\Windows\system32\CQJ6dWK8fLhXjCk.exe 5985C:\Windows\SysWOW64\hCwkUVrlOtPySiD.exe
        29⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        30⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
        
        C:\Windows\SysWOW64\OdEL8gRZqY.exe
        
        C:\Windows\system32\OdEL8gRZqY.exe 5985C:\Windows\SysWOW64\CQJ6dWK8fLhXjCk.exe
        30⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        31⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\CbF3pnG5aHdKfLg.exe
        
        C:\Windows\system32\CbF3pnG5aHdKfLg.exe 5985C:\Windows\SysWOW64\OdEL8gRZqY.exe
        31⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        32⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Windows\SysWOW64\pOBtzP0yc.exe
        
        C:\Windows\system32\pOBtzP0yc.exe 5985C:\Windows\SysWOW64\CbF3pnG5aHdKfLg.exe
        32⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:792
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        33⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\S9gTXqjYCkVzNx0.exe
        
        C:\Windows\system32\S9gTXqjYCkVzNx0.exe 5985C:\Windows\SysWOW64\pOBtzP0yc.exe
        33⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        34⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\VRZ9hYXwjVlBzNc.exe
        
        C:\Windows\system32\VRZ9hYXwjVlBzNc.exe 5985C:\Windows\SysWOW64\S9gTXqjYCkVzNx0.exe
        34⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        35⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\ObD3pnG4aHsKfLg.exe
        
        C:\Windows\system32\ObD3pnG4aHsKfLg.exe 5985C:\Windows\SysWOW64\VRZ9hYXwjVlBzNc.exe
        35⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:876
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        36⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\u4pmH5sQJdKgZhX.exe
        
        C:\Windows\system32\u4pmH5sQJdKgZhX.exe 5985C:\Windows\SysWOW64\ObD3pnG4aHsKfLg.exe
        36⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        37⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        37⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\IG4aQH6sW7E9TqY.exe
        
        C:\Windows\system32\IG4aQH6sW7E9TqY.exe 5985C:\Windows\SysWOW64\u4pmH5sQJdKgZhX.exe
        37⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        38⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        38⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\fF4pmG5sQ6E8R9T.exe
        
        C:\Windows\system32\fF4pmG5sQ6E8R9T.exe 5985C:\Windows\SysWOW64\IG4aQH6sW7E9TqY.exe
        38⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        39⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\GnG4amH6sJfLgZh.exe
        
        C:\Windows\system32\GnG4amH6sJfLgZh.exe 5985C:\Windows\SysWOW64\fF4pmG5sQ6E8R9T.exe
        39⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        40⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\q3pmG5aQJdKfLhX.exe
        
        C:\Windows\system32\q3pmG5aQJdKfLhX.exe 5985C:\Windows\SysWOW64\GnG4amH6sJfLgZh.exe
        40⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Windows\SysWOW64\bmH5sWJ7dLgZhXk.exe
        
        C:\Windows\system32\bmH5sWJ7dLgZhXk.exe 5985C:\Windows\SysWOW64\q3pmG5aQJdKfLhX.exe
        41⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        42⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        42⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\zG5aQH6dW7R9TqY.exe
        
        C:\Windows\system32\zG5aQH6dW7R9TqY.exe 5985C:\Windows\SysWOW64\bmH5sWJ7dLgZhXk.exe
        42⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        43⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Windows\SysWOW64\Q5sQJ7dEKgZhXjV.exe
        
        C:\Windows\system32\Q5sQJ7dEKgZhXjV.exe 5985C:\Windows\SysWOW64\zG5aQH6dW7R9TqY.exe
        43⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        44⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\vaQH6sWK7E9TqYw.exe
        
        C:\Windows\system32\vaQH6sWK7E9TqYw.exe 5985C:\Windows\SysWOW64\Q5sQJ7dEKgZhXjV.exe
        44⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        45⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        45⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\gsQJ6dEK8R9TwUe.exe
        
        C:\Windows\system32\gsQJ6dEK8R9TwUe.exe 5985C:\Windows\SysWOW64\vaQH6sWK7E9TqYw.exe
        45⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\eD3onG4am6W7E8.exe
        
        C:\Windows\system32\eD3onG4am6W7E8.exe 5985C:\Windows\SysWOW64\gsQJ6dEK8R9TwUe.exe
        46⤵
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:328
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        47⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\OD2obF4pm5Q6E.exe
        
        C:\Windows\system32\OD2obF4pm5Q6E.exe 5985C:\Windows\SysWOW64\eD3onG4am6W7E8.exe
        47⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        48⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\mD3onG4am6W7E.exe
        
        C:\Windows\system32\mD3onG4am6W7E.exe 5985C:\Windows\SysWOW64\OD2obF4pm5Q6E.exe
        48⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        49⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        49⤵
        
        PID:872
        
        C:\Windows\SysWOW64\QCelIBrzPyAuSoF.exe
        
        C:\Windows\system32\QCelIBrzPyAuSoF.exe 5985C:\Windows\SysWOW64\mD3onG4am6W7E.exe
        49⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        50⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        50⤵
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Windows\SysWOW64\BlOBtxP0ySiDoFa.exe
        
        C:\Windows\system32\BlOBtxP0ySiDoFa.exe 5985C:\Windows\SysWOW64\QCelIBrzPyAuSoF.exe
        50⤵
        Adds Run key to start application
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        51⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        51⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\yONyxA0uv2b3n5Q.exe
        
        C:\Windows\system32\yONyxA0uv2b3n5Q.exe 5985C:\Windows\SysWOW64\BlOBtxP0ySiDoFa.exe
        51⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        52⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Windows\SysWOW64\HVelOBtzPyAiDoF.exe
        
        C:\Windows\system32\HVelOBtzPyAiDoF.exe 5985C:\Windows\SysWOW64\yONyxA0uv2b3n5Q.exe
        52⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        53⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        53⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\LNtxA0ucSiDpGaH.exe
        
        C:\Windows\system32\LNtxA0ucSiDpGaH.exe 5985C:\Windows\SysWOW64\HVelOBtzPyAiDoF.exe
        53⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        54⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        54⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\qycA1uvD2b4m5Q6.exe
        
        C:\Windows\system32\qycA1uvD2b4m5Q6.exe 5985C:\Windows\SysWOW64\LNtxA0ucSiDpGaH.exe
        54⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\dwme.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
        55⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Roaming\dwme.exe
        
        C:\Users\Admin\AppData\Roaming\dwme.exe auto
        55⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\XG4amH6sW7E8T.exe
        
        C:\Windows\system32\XG4amH6sW7E8T.exe 5985C:\Windows\SysWOW64\qycA1uvD2b4m5Q6.exe
        55⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dwme.exe

Filesize
100KB

MD5
690f94bbbfb021e269dae422155998b8

SHA1
a9206f9fc9881fd0e954d35d20108d5f67df6b79

SHA256
29df997900b6c5c6a0be0e74388168f352191fac0e030904f59c003b944ff366

SHA512
31b824a3a394a375602c94f2c3977e7eca1e32f6da33e09a098661d7493fbf4b3fcd13316f9baf26e643a38ed6ce73b1af0464a21d607f6c54eb0619cc87b995

Download Submit
\Windows\SysWOW64\D4amH6sWJfLgZh.exe

Filesize
1.7MB

MD5
d5fcd73cabc2e7ce6d86d7d3ab7dd2c2

SHA1
d8b1aa82b23d20e3164c5471e86c3e31646ee2bc

SHA256
694fef7d7c2f0a5fdf9110caac07b01c24be8653faed1d670e3a53679ccd4d26

SHA512
894446e782a21f6c9c8f6879e0fdcaac380152a7d4801449ac853de4f56c2a66fac1c4cb6f00f8a71547beae0524e15bdba846cee45a101b51ffeee308088f67

Download Submit
memory/348-295-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/372-359-0x0000000002B50000-0x0000000002F2E000-memory.dmp

Filesize
3.9MB

Download
memory/372-377-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/468-338-0x0000000002B10000-0x0000000002EEE000-memory.dmp

Filesize
3.9MB

Download
memory/468-158-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/468-356-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/760-275-0x0000000002B30000-0x0000000002F0E000-memory.dmp

Filesize
3.9MB

Download
memory/760-294-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/836-210-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/836-191-0x0000000002B40000-0x0000000002F1E000-memory.dmp

Filesize
3.9MB

Download
memory/992-199-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1140-262-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1308-317-0x0000000002BD0000-0x0000000002FAE000-memory.dmp

Filesize
3.9MB

Download
memory/1308-336-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/1328-220-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1344-314-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/1344-296-0x0000000002B10000-0x0000000002EEE000-memory.dmp

Filesize
3.9MB

Download
memory/1352-188-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/1352-159-0x0000000002C10000-0x0000000002FEE000-memory.dmp

Filesize
3.9MB

Download
memory/1520-388-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1520-211-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1528-380-0x0000000002C30000-0x000000000300E000-memory.dmp

Filesize
3.9MB

Download
memory/1528-398-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/1592-190-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1596-212-0x0000000002C60000-0x000000000303E000-memory.dmp

Filesize
3.9MB

Download
memory/1596-230-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/1636-1-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1636-0-0x0000000002B00000-0x0000000002EDE000-memory.dmp

Filesize
3.9MB

Download
memory/1636-2-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/1636-33-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/1636-30-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1656-358-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1660-172-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1692-367-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1748-337-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1756-274-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1788-346-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1832-125-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1932-379-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2020-122-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/2020-93-0x0000000002CE0000-0x00000000030BE000-memory.dmp

Filesize
3.9MB

Download
memory/2036-54-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/2036-36-0x0000000002B20000-0x0000000002EFE000-memory.dmp

Filesize
3.9MB

Download
memory/2056-92-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2212-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2260-304-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2300-401-0x0000000002D30000-0x000000000310E000-memory.dmp

Filesize
3.9MB

Download
memory/2364-73-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2388-316-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2480-400-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2508-35-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2572-89-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/2572-58-0x0000000002C60000-0x000000000303E000-memory.dmp

Filesize
3.9MB

Download
memory/2652-232-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2684-233-0x0000000002C50000-0x000000000302E000-memory.dmp

Filesize
3.9MB

Download
memory/2684-251-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/2716-253-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2836-241-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2840-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2840-272-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/2840-254-0x0000000002B10000-0x0000000002EEE000-memory.dmp

Filesize
3.9MB

Download
memory/2868-106-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2936-126-0x0000000002A50000-0x0000000002E2E000-memory.dmp

Filesize
3.9MB

Download
memory/2936-156-0x0000000000400000-0x00000000008B6000-memory.dmp

Filesize
4.7MB

Download
memory/2980-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2980-14-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2980-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads