Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 03:49
Behavioral task
behavioral1
Sample
dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe
-
Size
431KB
-
MD5
dce106dfbe765fcb247faf75528a6d81
-
SHA1
6284a2499709b1987bb144daf745617fbca742b4
-
SHA256
2cb9a2e5ecf3e396efd8dd748fd633a4d695fafc8941c2e04911786638cbb8d2
-
SHA512
47d5068f65f15dbc114b119a4a8d9b947bcc699e8e65c3811394e932d86e08dd13836176710ac34f381155dcd751f94fa1976f6c52e627e12c4daeaadfdeb38a
-
SSDEEP
12288:VekJnG34cbICiiPar0GNJ8XQ7P9GPQjWfV:W60G/+6MPmW
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Executes dropped EXE 64 IoCs
pid Process 3872 whmzwqf.exe 5112 ggqwgpn.exe 224 tflzppk.exe 1976 dexxaos.exe 3656 qrhufrr.exe 4344 vezklvy.exe 4704 izqazzw.exe 4460 scfkmcd.exe 1628 glmnpud.exe 840 qkqkatk.exe 2984 gxyfegh.exe 4592 qwclofg.exe 2112 dmxnffm.exe 1888 qzpdkjl.exe 1236 dmgtqms.exe 1732 nxwddqy.exe 3304 akftjtx.exe 4000 otlwmlx.exe 3868 akoyvtu.exe 1324 lrswnsc.exe 3860 yekttwb.exe 3980 lrtjzah.exe 4988 vbjtmvo.exe 1296 ioajsym.exe 4424 soehcxu.exe 2600 iobpdgs.exe 4636 vfwrmgp.exe 4812 gbxkcbq.exe 4164 tzamkjw.exe 2064 qxzmdqj.exe 4032 asaxtkk.exe 2304 qxaspqg.exe 4100 dkrivtf.exe 2884 nmhsqxt.exe 1996 ahyiwas.exe 4572 nuixbwr.exe 4888 ahzvhaq.exe 2560 kkpxudw.exe 1984 yfgvahd.exe 2068 lsqlglc.exe 1444 yfibuha.exe 2956 ihxlhkh.exe 368 vcobnoo.exe 2420 ipyqtsm.exe 1828 vcqgynl.exe 1072 fcumjmt.exe 2752 tplbxqr.exe 2932 czbmkty.exe 4964 qmsbqxw.exe 2236 ddneyxc.exe 4108 imthbxc.exe 388 sxjrpai.exe 2280 fkahceh.exe 2072 sxkxihg.exe 800 fkbuodn.exe 748 purfbgt.exe 3880 chiuhks.exe 208 qusknoq.exe 2412 dhjatsx.exe 1392 qgedbsv.exe 228 afqaurc.exe 2868 nsaqzvb.exe 4968 afrnfza.exe 1528 kphqsco.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\grrsppb.exe teicjld.exe File opened for modification C:\Windows\SysWOW64\mruzfqf.exe zecjamh.exe File opened for modification C:\Windows\SysWOW64\mbvmhdw.exe czfbuaq.exe File opened for modification C:\Windows\SysWOW64\bsabuwg.exe oiuyrfg.exe File created C:\Windows\SysWOW64\uaxvefv.exe lphkibp.exe File opened for modification C:\Windows\SysWOW64\inhyviz.exe vayipes.exe File opened for modification C:\Windows\SysWOW64\zipervr.exe mvfolzs.exe File opened for modification C:\Windows\SysWOW64\mvgcxzp.exe zipervr.exe File opened for modification C:\Windows\SysWOW64\kmawocw.exe xngbfuq.exe File opened for modification C:\Windows\SysWOW64\ipyqtsm.exe vcobnoo.exe File opened for modification C:\Windows\SysWOW64\jlontfa.exe hiycgct.exe File opened for modification C:\Windows\SysWOW64\fjswzek.exe swagtal.exe File created C:\Windows\SysWOW64\yrinprc.exe nseqesu.exe File opened for modification C:\Windows\SysWOW64\cafhzbs.exe sbtbpcs.exe File opened for modification C:\Windows\SysWOW64\dzjxpja.exe qmsijnu.exe File created C:\Windows\SysWOW64\qusknoq.exe chiuhks.exe File created C:\Windows\SysWOW64\zazublz.exe mnhevhb.exe File created C:\Windows\SysWOW64\wyhhosk.exe jzeffse.exe File opened for modification C:\Windows\SysWOW64\ingkjau.exe uaxvefv.exe File opened for modification C:\Windows\SysWOW64\sgfwzcx.exe ftwglgy.exe File opened for modification C:\Windows\SysWOW64\azyszxy.exe nbwpqxs.exe File opened for modification C:\Windows\SysWOW64\hwkdwdi.exe ujtfqhj.exe File created C:\Windows\SysWOW64\uhrpfuq.exe hqwnwml.exe File opened for modification C:\Windows\SysWOW64\xcztkfl.exe kpidebm.exe File opened for modification C:\Windows\SysWOW64\mnijhpy.exe zazublz.exe File opened for modification C:\Windows\SysWOW64\gxpjsuf.exe tcxumqg.exe File created C:\Windows\SysWOW64\krjncog.exe ahtdglr.exe File created C:\Windows\SysWOW64\ctmkdsy.exe pgvmyoz.exe File created C:\Windows\SysWOW64\tduwcca.exe jbflgzu.exe File created C:\Windows\SysWOW64\kjkxxdm.exe xwthrzn.exe File created C:\Windows\SysWOW64\ahtdglr.exe nucnbht.exe File created C:\Windows\SysWOW64\lqnrykj.exe ydwbshk.exe File opened for modification C:\Windows\SysWOW64\fcumjmt.exe vcqgynl.exe File created C:\Windows\SysWOW64\tplbxqr.exe fcumjmt.exe File opened for modification C:\Windows\SysWOW64\swegocs.exe fgjdgun.exe File opened for modification C:\Windows\SysWOW64\sudtnob.exe fhmehld.exe File opened for modification C:\Windows\SysWOW64\mjzpdaz.exe zoizxwb.exe File opened for modification C:\Windows\SysWOW64\axonjjf.exe qychyky.exe File opened for modification C:\Windows\SysWOW64\vjugnbm.exe lgfwzfy.exe File created C:\Windows\SysWOW64\nugpqtn.exe ahpzkxo.exe File created C:\Windows\SysWOW64\siwmxpm.exe fzpjuqu.exe File created C:\Windows\SysWOW64\lvwsism.exe bwjvyue.exe File created C:\Windows\SysWOW64\swcrahl.exe ilngfef.exe File created C:\Windows\SysWOW64\shkygnr.exe futiakt.exe File created C:\Windows\SysWOW64\grrktlv.exe wvrzmqu.exe File created C:\Windows\SysWOW64\fbseqdk.exe wzdudze.exe File opened for modification C:\Windows\SysWOW64\sjsombo.exe fwbygxh.exe File created C:\Windows\SysWOW64\nmhsqxt.exe dkrivtf.exe File opened for modification C:\Windows\SysWOW64\smcgbhe.exe ikneoey.exe File opened for modification C:\Windows\SysWOW64\fhmehld.exe smcgbhe.exe File created C:\Windows\SysWOW64\xwthrzn.exe jjjrmdo.exe File opened for modification C:\Windows\SysWOW64\oawdbrq.exe bnmnvnr.exe File created C:\Windows\SysWOW64\gcyurok.exe spgemsl.exe File created C:\Windows\SysWOW64\ulebybd.exe kmawocw.exe File created C:\Windows\SysWOW64\nptnmcx.exe accpyyy.exe File created C:\Windows\SysWOW64\ujxndjq.exe kghdqgk.exe File opened for modification C:\Windows\SysWOW64\nhsxqoq.exe digafpi.exe File opened for modification C:\Windows\SysWOW64\pummbjd.exe chuwvfw.exe File created C:\Windows\SysWOW64\cpdbhnc.exe pummbjd.exe File created C:\Windows\SysWOW64\rrbxfvc.exe deszzzd.exe File created C:\Windows\SysWOW64\xkpdapc.exe kxgnuld.exe File opened for modification C:\Windows\SysWOW64\uiwdbwp.exe hvnovsq.exe File opened for modification C:\Windows\SysWOW64\eyfncge.exe qdoxxlf.exe File opened for modification C:\Windows\SysWOW64\bvnshvp.exe oawdbrq.exe -
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asaxtkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kghdqgk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlontfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nmiifbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cpdbhnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nruxdce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kocdiip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zynmehc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njannue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvmgkyj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djkkqxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahsxvlu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yifqool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fzqwuiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afhbmja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neseiid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firliwd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zmmpltm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language esrbvbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language czfbuaq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrtkrcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language potyuit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lzojpor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gcyurok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afrnfza.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xaliwmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjbsxfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gwkidjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ogpsplz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdmwsjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uxpxshc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efygoay.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvnshvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qgjqvbs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djlxceh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oawdbrq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language giwaymk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxsvga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phzpgno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language usxqcky.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yaozgvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifqgnha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language albszbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfbpwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmcrlwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmhlocx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcpmsdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ceycswc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjtmvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hunqprg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnfbaxu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ogczfub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ckhmxie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcqgynl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language purfbgt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xckpmsr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbykssc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mjzpdaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language digafpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nseqesu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wfxsebb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zsreeqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dspiohd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fzpjuqu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3872 4836 dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe 83 PID 4836 wrote to memory of 3872 4836 dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe 83 PID 4836 wrote to memory of 3872 4836 dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe 83 PID 3872 wrote to memory of 5112 3872 whmzwqf.exe 84 PID 3872 wrote to memory of 5112 3872 whmzwqf.exe 84 PID 3872 wrote to memory of 5112 3872 whmzwqf.exe 84 PID 5112 wrote to memory of 224 5112 ggqwgpn.exe 85 PID 5112 wrote to memory of 224 5112 ggqwgpn.exe 85 PID 5112 wrote to memory of 224 5112 ggqwgpn.exe 85 PID 224 wrote to memory of 1976 224 tflzppk.exe 86 PID 224 wrote to memory of 1976 224 tflzppk.exe 86 PID 224 wrote to memory of 1976 224 tflzppk.exe 86 PID 1976 wrote to memory of 3656 1976 dexxaos.exe 87 PID 1976 wrote to memory of 3656 1976 dexxaos.exe 87 PID 1976 wrote to memory of 3656 1976 dexxaos.exe 87 PID 3656 wrote to memory of 4344 3656 qrhufrr.exe 88 PID 3656 wrote to memory of 4344 3656 qrhufrr.exe 88 PID 3656 wrote to memory of 4344 3656 qrhufrr.exe 88 PID 4344 wrote to memory of 4704 4344 vezklvy.exe 89 PID 4344 wrote to memory of 4704 4344 vezklvy.exe 89 PID 4344 wrote to memory of 4704 4344 vezklvy.exe 89 PID 4704 wrote to memory of 4460 4704 izqazzw.exe 90 PID 4704 wrote to memory of 4460 4704 izqazzw.exe 90 PID 4704 wrote to memory of 4460 4704 izqazzw.exe 90 PID 4460 wrote to memory of 1628 4460 scfkmcd.exe 91 PID 4460 wrote to memory of 1628 4460 scfkmcd.exe 91 PID 4460 wrote to memory of 1628 4460 scfkmcd.exe 91 PID 1628 wrote to memory of 840 1628 glmnpud.exe 92 PID 1628 wrote to memory of 840 1628 glmnpud.exe 92 PID 1628 wrote to memory of 840 1628 glmnpud.exe 92 PID 840 wrote to memory of 2984 840 qkqkatk.exe 93 PID 840 wrote to memory of 2984 840 qkqkatk.exe 93 PID 840 wrote to memory of 2984 840 qkqkatk.exe 93 PID 2984 wrote to memory of 4592 2984 gxyfegh.exe 94 PID 2984 wrote to memory of 4592 2984 gxyfegh.exe 94 PID 2984 wrote to memory of 4592 2984 gxyfegh.exe 94 PID 4592 wrote to memory of 2112 4592 qwclofg.exe 95 PID 4592 wrote to memory of 2112 4592 qwclofg.exe 95 PID 4592 wrote to memory of 2112 4592 qwclofg.exe 95 PID 2112 wrote to memory of 1888 2112 dmxnffm.exe 96 PID 2112 wrote to memory of 1888 2112 dmxnffm.exe 96 PID 2112 wrote to memory of 1888 2112 dmxnffm.exe 96 PID 1888 wrote to memory of 1236 1888 qzpdkjl.exe 97 PID 1888 wrote to memory of 1236 1888 qzpdkjl.exe 97 PID 1888 wrote to memory of 1236 1888 qzpdkjl.exe 97 PID 1236 wrote to memory of 1732 1236 dmgtqms.exe 98 PID 1236 wrote to memory of 1732 1236 dmgtqms.exe 98 PID 1236 wrote to memory of 1732 1236 dmgtqms.exe 98 PID 1732 wrote to memory of 3304 1732 nxwddqy.exe 99 PID 1732 wrote to memory of 3304 1732 nxwddqy.exe 99 PID 1732 wrote to memory of 3304 1732 nxwddqy.exe 99 PID 3304 wrote to memory of 4000 3304 akftjtx.exe 100 PID 3304 wrote to memory of 4000 3304 akftjtx.exe 100 PID 3304 wrote to memory of 4000 3304 akftjtx.exe 100 PID 4000 wrote to memory of 3868 4000 otlwmlx.exe 101 PID 4000 wrote to memory of 3868 4000 otlwmlx.exe 101 PID 4000 wrote to memory of 3868 4000 otlwmlx.exe 101 PID 3868 wrote to memory of 1324 3868 akoyvtu.exe 102 PID 3868 wrote to memory of 1324 3868 akoyvtu.exe 102 PID 3868 wrote to memory of 1324 3868 akoyvtu.exe 102 PID 1324 wrote to memory of 3860 1324 lrswnsc.exe 103 PID 1324 wrote to memory of 3860 1324 lrswnsc.exe 103 PID 1324 wrote to memory of 3860 1324 lrswnsc.exe 103 PID 3860 wrote to memory of 3980 3860 yekttwb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\whmzwqf.exeC:\Windows\system32\whmzwqf.exe 1032 "C:\Users\Admin\AppData\Local\Temp\dce106dfbe765fcb247faf75528a6d81_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\ggqwgpn.exeC:\Windows\system32\ggqwgpn.exe 1156 "C:\Windows\SysWOW64\whmzwqf.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\tflzppk.exeC:\Windows\system32\tflzppk.exe 1152 "C:\Windows\SysWOW64\ggqwgpn.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\dexxaos.exeC:\Windows\system32\dexxaos.exe 1160 "C:\Windows\SysWOW64\tflzppk.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\qrhufrr.exeC:\Windows\system32\qrhufrr.exe 1168 "C:\Windows\SysWOW64\dexxaos.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\vezklvy.exeC:\Windows\system32\vezklvy.exe 1164 "C:\Windows\SysWOW64\qrhufrr.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\izqazzw.exeC:\Windows\system32\izqazzw.exe 1176 "C:\Windows\SysWOW64\vezklvy.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\scfkmcd.exeC:\Windows\system32\scfkmcd.exe 1172 "C:\Windows\SysWOW64\izqazzw.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\glmnpud.exeC:\Windows\system32\glmnpud.exe 1184 "C:\Windows\SysWOW64\scfkmcd.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\qkqkatk.exeC:\Windows\system32\qkqkatk.exe 1180 "C:\Windows\SysWOW64\glmnpud.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\gxyfegh.exeC:\Windows\system32\gxyfegh.exe 1192 "C:\Windows\SysWOW64\qkqkatk.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\qwclofg.exeC:\Windows\system32\qwclofg.exe 1188 "C:\Windows\SysWOW64\gxyfegh.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\dmxnffm.exeC:\Windows\system32\dmxnffm.exe 1196 "C:\Windows\SysWOW64\qwclofg.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\qzpdkjl.exeC:\Windows\system32\qzpdkjl.exe 1200 "C:\Windows\SysWOW64\dmxnffm.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\dmgtqms.exeC:\Windows\system32\dmgtqms.exe 1012 "C:\Windows\SysWOW64\qzpdkjl.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\nxwddqy.exeC:\Windows\system32\nxwddqy.exe 1216 "C:\Windows\SysWOW64\dmgtqms.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\akftjtx.exeC:\Windows\system32\akftjtx.exe 1208 "C:\Windows\SysWOW64\nxwddqy.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\otlwmlx.exeC:\Windows\system32\otlwmlx.exe 1212 "C:\Windows\SysWOW64\akftjtx.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\akoyvtu.exeC:\Windows\system32\akoyvtu.exe 1220 "C:\Windows\SysWOW64\otlwmlx.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\lrswnsc.exeC:\Windows\system32\lrswnsc.exe 1228 "C:\Windows\SysWOW64\akoyvtu.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\yekttwb.exeC:\Windows\system32\yekttwb.exe 1224 "C:\Windows\SysWOW64\lrswnsc.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\lrtjzah.exeC:\Windows\system32\lrtjzah.exe 1248 "C:\Windows\SysWOW64\yekttwb.exe"23⤵
- Executes dropped EXE
PID:3980 -
C:\Windows\SysWOW64\vbjtmvo.exeC:\Windows\system32\vbjtmvo.exe 1232 "C:\Windows\SysWOW64\lrtjzah.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Windows\SysWOW64\ioajsym.exeC:\Windows\system32\ioajsym.exe 1236 "C:\Windows\SysWOW64\vbjtmvo.exe"25⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\soehcxu.exeC:\Windows\system32\soehcxu.exe 1240 "C:\Windows\SysWOW64\ioajsym.exe"26⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\iobpdgs.exeC:\Windows\system32\iobpdgs.exe 1252 "C:\Windows\SysWOW64\soehcxu.exe"27⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\vfwrmgp.exeC:\Windows\system32\vfwrmgp.exe 1244 "C:\Windows\SysWOW64\iobpdgs.exe"28⤵
- Executes dropped EXE
PID:4636 -
C:\Windows\SysWOW64\gbxkcbq.exeC:\Windows\system32\gbxkcbq.exe 1260 "C:\Windows\SysWOW64\vfwrmgp.exe"29⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\tzamkjw.exeC:\Windows\system32\tzamkjw.exe 1256 "C:\Windows\SysWOW64\gbxkcbq.exe"30⤵
- Executes dropped EXE
PID:4164 -
C:\Windows\SysWOW64\dyekvid.exeC:\Windows\system32\dyekvid.exe 1268 "C:\Windows\SysWOW64\tzamkjw.exe"31⤵PID:4544
-
C:\Windows\SysWOW64\qxzmdqj.exeC:\Windows\system32\qxzmdqj.exe 1272 "C:\Windows\SysWOW64\dyekvid.exe"32⤵
- Executes dropped EXE
PID:2064 -
C:\Windows\SysWOW64\asaxtkk.exeC:\Windows\system32\asaxtkk.exe 1320 "C:\Windows\SysWOW64\qxzmdqj.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032 -
C:\Windows\SysWOW64\qxaspqg.exeC:\Windows\system32\qxaspqg.exe 1276 "C:\Windows\SysWOW64\asaxtkk.exe"34⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\dkrivtf.exeC:\Windows\system32\dkrivtf.exe 1280 "C:\Windows\SysWOW64\qxaspqg.exe"35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4100 -
C:\Windows\SysWOW64\nmhsqxt.exeC:\Windows\system32\nmhsqxt.exe 1264 "C:\Windows\SysWOW64\dkrivtf.exe"36⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\ahyiwas.exeC:\Windows\system32\ahyiwas.exe 1288 "C:\Windows\SysWOW64\nmhsqxt.exe"37⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\nuixbwr.exeC:\Windows\system32\nuixbwr.exe 1292 "C:\Windows\SysWOW64\ahyiwas.exe"38⤵
- Executes dropped EXE
PID:4572 -
C:\Windows\SysWOW64\ahzvhaq.exeC:\Windows\system32\ahzvhaq.exe 1136 "C:\Windows\SysWOW64\nuixbwr.exe"39⤵
- Executes dropped EXE
PID:4888 -
C:\Windows\SysWOW64\kkpxudw.exeC:\Windows\system32\kkpxudw.exe 1204 "C:\Windows\SysWOW64\ahzvhaq.exe"40⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\yfgvahd.exeC:\Windows\system32\yfgvahd.exe 1304 "C:\Windows\SysWOW64\kkpxudw.exe"41⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\SysWOW64\lsqlglc.exeC:\Windows\system32\lsqlglc.exe 1308 "C:\Windows\SysWOW64\yfgvahd.exe"42⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\yfibuha.exeC:\Windows\system32\yfibuha.exe 1312 "C:\Windows\SysWOW64\lsqlglc.exe"43⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\ihxlhkh.exeC:\Windows\system32\ihxlhkh.exe 1324 "C:\Windows\SysWOW64\yfibuha.exe"44⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\vcobnoo.exeC:\Windows\system32\vcobnoo.exe 1316 "C:\Windows\SysWOW64\ihxlhkh.exe"45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:368 -
C:\Windows\SysWOW64\ipyqtsm.exeC:\Windows\system32\ipyqtsm.exe 1300 "C:\Windows\SysWOW64\vcobnoo.exe"46⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\vcqgynl.exeC:\Windows\system32\vcqgynl.exe 1284 "C:\Windows\SysWOW64\ipyqtsm.exe"47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Windows\SysWOW64\fcumjmt.exeC:\Windows\system32\fcumjmt.exe 952 "C:\Windows\SysWOW64\vcqgynl.exe"48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1072 -
C:\Windows\SysWOW64\tplbxqr.exeC:\Windows\system32\tplbxqr.exe 1340 "C:\Windows\SysWOW64\fcumjmt.exe"49⤵
- Executes dropped EXE
PID:2752 -
C:\Windows\SysWOW64\czbmkty.exeC:\Windows\system32\czbmkty.exe 1344 "C:\Windows\SysWOW64\tplbxqr.exe"50⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\SysWOW64\qmsbqxw.exeC:\Windows\system32\qmsbqxw.exe 1132 "C:\Windows\SysWOW64\czbmkty.exe"51⤵
- Executes dropped EXE
PID:4964 -
C:\Windows\SysWOW64\ddneyxc.exeC:\Windows\system32\ddneyxc.exe 1364 "C:\Windows\SysWOW64\qmsbqxw.exe"52⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\SysWOW64\imthbxc.exeC:\Windows\system32\imthbxc.exe 1348 "C:\Windows\SysWOW64\ddneyxc.exe"53⤵
- Executes dropped EXE
PID:4108 -
C:\Windows\SysWOW64\sxjrpai.exeC:\Windows\system32\sxjrpai.exe 1356 "C:\Windows\SysWOW64\imthbxc.exe"54⤵
- Executes dropped EXE
PID:388 -
C:\Windows\SysWOW64\fkahceh.exeC:\Windows\system32\fkahceh.exe 1360 "C:\Windows\SysWOW64\sxjrpai.exe"55⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\sxkxihg.exeC:\Windows\system32\sxkxihg.exe 1368 "C:\Windows\SysWOW64\fkahceh.exe"56⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\fkbuodn.exeC:\Windows\system32\fkbuodn.exe 1352 "C:\Windows\SysWOW64\sxkxihg.exe"57⤵
- Executes dropped EXE
PID:800 -
C:\Windows\SysWOW64\purfbgt.exeC:\Windows\system32\purfbgt.exe 1372 "C:\Windows\SysWOW64\fkbuodn.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:748 -
C:\Windows\SysWOW64\chiuhks.exeC:\Windows\system32\chiuhks.exe 1380 "C:\Windows\SysWOW64\purfbgt.exe"59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3880 -
C:\Windows\SysWOW64\qusknoq.exeC:\Windows\system32\qusknoq.exe 1384 "C:\Windows\SysWOW64\chiuhks.exe"60⤵
- Executes dropped EXE
PID:208 -
C:\Windows\SysWOW64\dhjatsx.exeC:\Windows\system32\dhjatsx.exe 1388 "C:\Windows\SysWOW64\qusknoq.exe"61⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\qgedbsv.exeC:\Windows\system32\qgedbsv.exe 1376 "C:\Windows\SysWOW64\dhjatsx.exe"62⤵
- Executes dropped EXE
PID:1392 -
C:\Windows\SysWOW64\afqaurc.exeC:\Windows\system32\afqaurc.exe 1392 "C:\Windows\SysWOW64\qgedbsv.exe"63⤵
- Executes dropped EXE
PID:228 -
C:\Windows\SysWOW64\nsaqzvb.exeC:\Windows\system32\nsaqzvb.exe 1400 "C:\Windows\SysWOW64\afqaurc.exe"64⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\afrnfza.exeC:\Windows\system32\afrnfza.exe 1296 "C:\Windows\SysWOW64\nsaqzvb.exe"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Windows\SysWOW64\kphqsco.exeC:\Windows\system32\kphqsco.exe 1408 "C:\Windows\SysWOW64\afrnfza.exe"66⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\xcynyyn.exeC:\Windows\system32\xcynyyn.exe 1404 "C:\Windows\SysWOW64\kphqsco.exe"67⤵PID:1060
-
C:\Windows\SysWOW64\kpidebm.exeC:\Windows\system32\kpidebm.exe 1412 "C:\Windows\SysWOW64\xcynyyn.exe"68⤵
- Drops file in System32 directory
PID:2780 -
C:\Windows\SysWOW64\xcztkfl.exeC:\Windows\system32\xcztkfl.exe 1424 "C:\Windows\SysWOW64\kpidebm.exe"69⤵PID:1056
-
C:\Windows\SysWOW64\ikeqces.exeC:\Windows\system32\ikeqces.exe 1420 "C:\Windows\SysWOW64\xcztkfl.exe"70⤵PID:3640
-
C:\Windows\SysWOW64\vxvgiir.exeC:\Windows\system32\vxvgiir.exe 1428 "C:\Windows\SysWOW64\ikeqces.exe"71⤵PID:1248
-
C:\Windows\SysWOW64\ikneoey.exeC:\Windows\system32\ikneoey.exe 1416 "C:\Windows\SysWOW64\vxvgiir.exe"72⤵
- Drops file in System32 directory
PID:4504 -
C:\Windows\SysWOW64\smcgbhe.exeC:\Windows\system32\smcgbhe.exe 1432 "C:\Windows\SysWOW64\ikneoey.exe"73⤵
- Drops file in System32 directory
PID:1292 -
C:\Windows\SysWOW64\fhmehld.exeC:\Windows\system32\fhmehld.exe 1436 "C:\Windows\SysWOW64\smcgbhe.exe"74⤵
- Drops file in System32 directory
PID:1500 -
C:\Windows\SysWOW64\sudtnob.exeC:\Windows\system32\sudtnob.exe 1444 "C:\Windows\SysWOW64\fhmehld.exe"75⤵PID:4764
-
C:\Windows\SysWOW64\fhvjssa.exeC:\Windows\system32\fhvjssa.exe 1448 "C:\Windows\SysWOW64\sudtnob.exe"76⤵PID:4804
-
C:\Windows\SysWOW64\pkkuonp.exeC:\Windows\system32\pkkuonp.exe 1440 "C:\Windows\SysWOW64\fhvjssa.exe"77⤵PID:2980
-
C:\Windows\SysWOW64\cfujtrn.exeC:\Windows\system32\cfujtrn.exe 1452 "C:\Windows\SysWOW64\pkkuonp.exe"78⤵PID:3976
-
C:\Windows\SysWOW64\qslzzvm.exeC:\Windows\system32\qslzzvm.exe 1460 "C:\Windows\SysWOW64\cfujtrn.exe"79⤵PID:1616
-
C:\Windows\SysWOW64\dfdpfzl.exeC:\Windows\system32\dfdpfzl.exe 1456 "C:\Windows\SysWOW64\qslzzvm.exe"80⤵PID:4716
-
C:\Windows\SysWOW64\nhszscz.exeC:\Windows\system32\nhszscz.exe 1396 "C:\Windows\SysWOW64\dfdpfzl.exe"81⤵PID:1240
-
C:\Windows\SysWOW64\accpyyy.exeC:\Windows\system32\accpyyy.exe 1476 "C:\Windows\SysWOW64\nhszscz.exe"82⤵
- Drops file in System32 directory
PID:4540 -
C:\Windows\SysWOW64\nptnmcx.exeC:\Windows\system32\nptnmcx.exe 1468 "C:\Windows\SysWOW64\accpyyy.exe"83⤵PID:1756
-
C:\Windows\SysWOW64\acdcsgv.exeC:\Windows\system32\acdcsgv.exe 1480 "C:\Windows\SysWOW64\nptnmcx.exe"84⤵PID:5004
-
C:\Windows\SysWOW64\kfanfjc.exeC:\Windows\system32\kfanfjc.exe 1484 "C:\Windows\SysWOW64\acdcsgv.exe"85⤵PID:4020
-
C:\Windows\SysWOW64\xskclfj.exeC:\Windows\system32\xskclfj.exe 1492 "C:\Windows\SysWOW64\kfanfjc.exe"86⤵PID:3364
-
C:\Windows\SysWOW64\knbsqih.exeC:\Windows\system32\knbsqih.exe 1488 "C:\Windows\SysWOW64\xskclfj.exe"87⤵PID:3520
-
C:\Windows\SysWOW64\xaliwmg.exeC:\Windows\system32\xaliwmg.exe 1500 "C:\Windows\SysWOW64\knbsqih.exe"88⤵
- System Location Discovery: System Language Discovery
PID:3076 -
C:\Windows\SysWOW64\hdisrpm.exeC:\Windows\system32\hdisrpm.exe 1504 "C:\Windows\SysWOW64\xaliwmg.exe"89⤵PID:432
-
C:\Windows\SysWOW64\vmodupm.exeC:\Windows\system32\vmodupm.exe 1472 "C:\Windows\SysWOW64\hdisrpm.exe"90⤵PID:2044
-
C:\Windows\SysWOW64\ikjgdps.exeC:\Windows\system32\ikjgdps.exe 1508 "C:\Windows\SysWOW64\vmodupm.exe"91⤵PID:4072
-
C:\Windows\SysWOW64\vxtvjtr.exeC:\Windows\system32\vxtvjtr.exe 1512 "C:\Windows\SysWOW64\ikjgdps.exe"92⤵PID:3680
-
C:\Windows\SysWOW64\faqgwwx.exeC:\Windows\system32\faqgwwx.exe 1496 "C:\Windows\SysWOW64\vxtvjtr.exe"93⤵PID:452
-
C:\Windows\SysWOW64\snavcaw.exeC:\Windows\system32\snavcaw.exe 1532 "C:\Windows\SysWOW64\faqgwwx.exe"94⤵PID:4520
-
C:\Windows\SysWOW64\firliwd.exeC:\Windows\system32\firliwd.exe 1520 "C:\Windows\SysWOW64\snavcaw.exe"95⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Windows\SysWOW64\svbbnab.exeC:\Windows\system32\svbbnab.exe 1524 "C:\Windows\SysWOW64\firliwd.exe"96⤵PID:3332
-
C:\Windows\SysWOW64\cyyljdi.exeC:\Windows\system32\cyyljdi.exe 1536 "C:\Windows\SysWOW64\svbbnab.exe"97⤵PID:3660
-
C:\Windows\SysWOW64\hlibogg.exeC:\Windows\system32\hlibogg.exe 1516 "C:\Windows\SysWOW64\cyyljdi.exe"98⤵PID:4364
-
C:\Windows\SysWOW64\ugzrukn.exeC:\Windows\system32\ugzrukn.exe 1528 "C:\Windows\SysWOW64\hlibogg.exe"99⤵PID:4984
-
C:\Windows\SysWOW64\itjoagm.exeC:\Windows\system32\itjoagm.exe 1336 "C:\Windows\SysWOW64\ugzrukn.exe"100⤵PID:5052
-
C:\Windows\SysWOW64\vjmrjok.exeC:\Windows\system32\vjmrjok.exe 1148 "C:\Windows\SysWOW64\itjoagm.exe"101⤵PID:1784
-
C:\Windows\SysWOW64\fiqotnr.exeC:\Windows\system32\fiqotnr.exe 1556 "C:\Windows\SysWOW64\vjmrjok.exe"102⤵PID:3644
-
C:\Windows\SysWOW64\sdhezrq.exeC:\Windows\system32\sdhezrq.exe 1548 "C:\Windows\SysWOW64\fiqotnr.exe"103⤵PID:2860
-
C:\Windows\SysWOW64\fqrufvx.exeC:\Windows\system32\fqrufvx.exe 1560 "C:\Windows\SysWOW64\sdhezrq.exe"104⤵PID:2820
-
C:\Windows\SysWOW64\ptoeaqd.exeC:\Windows\system32\ptoeaqd.exe 1568 "C:\Windows\SysWOW64\fqrufvx.exe"105⤵PID:756
-
C:\Windows\SysWOW64\cgyuguc.exeC:\Windows\system32\cgyuguc.exe 1076 "C:\Windows\SysWOW64\ptoeaqd.exe"106⤵PID:4624
-
C:\Windows\SysWOW64\pbpklya.exeC:\Windows\system32\pbpklya.exe 1572 "C:\Windows\SysWOW64\cgyuguc.exe"107⤵PID:704
-
C:\Windows\SysWOW64\cozzrbh.exeC:\Windows\system32\cozzrbh.exe 1576 "C:\Windows\SysWOW64\pbpklya.exe"108⤵PID:3236
-
C:\Windows\SysWOW64\mqwkffo.exeC:\Windows\system32\mqwkffo.exe 1328 "C:\Windows\SysWOW64\cozzrbh.exe"109⤵PID:4612
-
C:\Windows\SysWOW64\zdghkam.exeC:\Windows\system32\zdghkam.exe 1584 "C:\Windows\SysWOW64\mqwkffo.exe"110⤵PID:2948
-
C:\Windows\SysWOW64\nyxxyel.exeC:\Windows\system32\nyxxyel.exe 1580 "C:\Windows\SysWOW64\zdghkam.exe"111⤵PID:1812
-
C:\Windows\SysWOW64\alhneik.exeC:\Windows\system32\alhneik.exe 1592 "C:\Windows\SysWOW64\nyxxyel.exe"112⤵PID:1580
-
C:\Windows\SysWOW64\kowxrly.exeC:\Windows\system32\kowxrly.exe 1596 "C:\Windows\SysWOW64\alhneik.exe"113⤵PID:3456
-
C:\Windows\SysWOW64\xbonxhx.exeC:\Windows\system32\xbonxhx.exe 1600 "C:\Windows\SysWOW64\kowxrly.exe"114⤵PID:5012
-
C:\Windows\SysWOW64\kwfddlw.exeC:\Windows\system32\kwfddlw.exe 1588 "C:\Windows\SysWOW64\xbonxhx.exe"115⤵PID:4940
-
C:\Windows\SysWOW64\xjpsjpu.exeC:\Windows\system32\xjpsjpu.exe 1608 "C:\Windows\SysWOW64\kwfddlw.exe"116⤵PID:2108
-
C:\Windows\SysWOW64\hmedesj.exeC:\Windows\system32\hmedesj.exe 1604 "C:\Windows\SysWOW64\xjpsjpu.exe"117⤵PID:4696
-
C:\Windows\SysWOW64\uzwskwi.exeC:\Windows\system32\uzwskwi.exe 1620 "C:\Windows\SysWOW64\hmedesj.exe"118⤵PID:4712
-
C:\Windows\SysWOW64\hunqprg.exeC:\Windows\system32\hunqprg.exe 1540 "C:\Windows\SysWOW64\uzwskwi.exe"119⤵
- System Location Discovery: System Language Discovery
PID:3720 -
C:\Windows\SysWOW64\ukityam.exeC:\Windows\system32\ukityam.exe 1616 "C:\Windows\SysWOW64\hunqprg.exe"120⤵PID:3160
-
C:\Windows\SysWOW64\fgjdgun.exeC:\Windows\system32\fgjdgun.exe 1628 "C:\Windows\SysWOW64\ukityam.exe"121⤵
- Drops file in System32 directory
PID:4372 -
C:\Windows\SysWOW64\swegocs.exeC:\Windows\system32\swegocs.exe 1636 "C:\Windows\SysWOW64\fgjdgun.exe"122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-