metasploit | 58fa7103a6da18ad8039c901c10af971627efdfb77a27f55a950aa37f4d04dc8

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe
Size

476KB
MD5

f3a6663b8cb810e905ff5c7bed9ef67e
SHA1

8e832fbcd04fad6c103bc8753ad87863454830ac
SHA256

58fa7103a6da18ad8039c901c10af971627efdfb77a27f55a950aa37f4d04dc8
SHA512

986064204320e6b1100e9c83e4691ee1d3aad06cdda575a723e6f49de9ed0ea0c5862b0d87e665167f9e74896dd0cdeaa12de6e1bb6753e68c56387154f98095
SSDEEP

6144:jFeLlS5FZCAv2wFR24biJjWti/9q7R/ck6pSDy4N5q39dVdnNn1u9/TPr5P6uzPh:JD6AvTFgJVWt49y5YeE8RhpQetCO

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 64 IoCs

pid	Process
2736	bljiez.exe
2688	bljiez.exe
2616	hufayr.exe
580	hufayr.exe
2164	tkggih.exe
1748	tkggih.exe
2872	mtydze.exe
1756	mtydze.exe
2676	ifstrx.exe
2324	ifstrx.exe
1472	woiegd.exe
2092	woiegd.exe
1464	yfyrju.exe
1640	yfyrju.exe
2516	wyfefw.exe
2292	wyfefw.exe
2060	nmdsdo.exe
2844	nmdsdo.exe
2740	krjihq.exe
2604	krjihq.exe
3004	qnrxar.exe
988	qnrxar.exe
1608	fomivh.exe
2212	fomivh.exe
2004	jmitcq.exe
2040	jmitcq.exe
1744	khjlqm.exe
2456	khjlqm.exe
2408	jlrbcn.exe
2276	jlrbcn.exe
552	vjttvq.exe
1200	vjttvq.exe
2500	tbsgrt.exe
2972	tbsgrt.exe
2168	derosq.exe
1652	derosq.exe
1632	hggmcd.exe
2804	hggmcd.exe
2692	qqumib.exe
2700	qqumib.exe
2640	zlthse.exe
772	zlthse.exe
984	lnxnot.exe
1560	lnxnot.exe
2888	xanfwf.exe
1148	xanfwf.exe
2072	hgqszz.exe
1696	hgqszz.exe
1048	qcnvvd.exe
2676	qcnvvd.exe
1472	ekxywd.exe
1492	ekxywd.exe
1668	wciopv.exe
828	wciopv.exe
2304	khpduq.exe
2536	khpduq.exe
2384	ckegqv.exe
2784	ckegqv.exe
2828	qwhwur.exe
2704	qwhwur.exe
2636	flruud.exe
2640	flruud.exe
1792	ryhmtp.exe
2436	ryhmtp.exe

Loads dropped DLL 64 IoCs

pid	Process
2720	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe
2720	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe
2736	bljiez.exe
2736	bljiez.exe
2688	bljiez.exe
2688	bljiez.exe
2616	hufayr.exe
2616	hufayr.exe
580	hufayr.exe
580	hufayr.exe
2164	tkggih.exe
2164	tkggih.exe
1748	tkggih.exe
1748	tkggih.exe
2872	mtydze.exe
2872	mtydze.exe
1756	mtydze.exe
1756	mtydze.exe
2676	ifstrx.exe
2676	ifstrx.exe
2324	ifstrx.exe
2324	ifstrx.exe
1472	woiegd.exe
1472	woiegd.exe
2092	woiegd.exe
2092	woiegd.exe
1464	yfyrju.exe
1464	yfyrju.exe
1640	yfyrju.exe
1640	yfyrju.exe
2516	wyfefw.exe
2516	wyfefw.exe
2292	wyfefw.exe
2292	wyfefw.exe
2060	nmdsdo.exe
2060	nmdsdo.exe
2844	nmdsdo.exe
2844	nmdsdo.exe
2740	krjihq.exe
2740	krjihq.exe
2604	krjihq.exe
2604	krjihq.exe
3004	qnrxar.exe
3004	qnrxar.exe
988	qnrxar.exe
988	qnrxar.exe
1608	fomivh.exe
1608	fomivh.exe
2212	fomivh.exe
2212	fomivh.exe
2004	jmitcq.exe
2004	jmitcq.exe
2040	jmitcq.exe
2040	jmitcq.exe
1744	khjlqm.exe
1744	khjlqm.exe
2456	khjlqm.exe
2456	khjlqm.exe
2408	jlrbcn.exe
2408	jlrbcn.exe
2276	jlrbcn.exe
2276	jlrbcn.exe
552	vjttvq.exe
552	vjttvq.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dqqexs.exe	pxvomo.exe
File created	C:\Windows\SysWOW64\tcyguc.exe	kvpyvt.exe
File created	C:\Windows\SysWOW64\xsmgwk.exe	dfhyce.exe
File opened for modification	C:\Windows\SysWOW64\prnhib.exe	gjfzja.exe
File opened for modification	C:\Windows\SysWOW64\fzdwvz.exe	orcowy.exe
File created	C:\Windows\SysWOW64\hvqcwt.exe	nikccn.exe
File opened for modification	C:\Windows\SysWOW64\yfyrju.exe	woiegd.exe
File opened for modification	C:\Windows\SysWOW64\naycvr.exe	bqtwqk.exe
File created	C:\Windows\SysWOW64\aknfkn.exe	lghqes.exe
File opened for modification	C:\Windows\SysWOW64\tqhyhh.exe	ygflyy.exe
File created	C:\Windows\SysWOW64\uxfuci.exe	emtzbc.exe
File created	C:\Windows\SysWOW64\oipysh.exe	xmrvwd.exe
File opened for modification	C:\Windows\SysWOW64\fomivh.exe	qnrxar.exe
File created	C:\Windows\SysWOW64\qwhwur.exe	ckegqv.exe
File created	C:\Windows\SysWOW64\sttftb.exe	lsyuys.exe
File created	C:\Windows\SysWOW64\sifpbm.exe	epkzxr.exe
File opened for modification	C:\Windows\SysWOW64\knojso.exe	qaijyi.exe
File opened for modification	C:\Windows\SysWOW64\ufwpae.exe	dgvhbv.exe
File created	C:\Windows\SysWOW64\rdmfev.exe	xhyfkp.exe
File opened for modification	C:\Windows\SysWOW64\nmdsdo.exe	wyfefw.exe
File created	C:\Windows\SysWOW64\flruud.exe	qwhwur.exe
File created	C:\Windows\SysWOW64\yasrou.exe	dqqexs.exe
File opened for modification	C:\Windows\SysWOW64\emtzbc.exe	jzgzhw.exe
File opened for modification	C:\Windows\SysWOW64\xsmgwk.exe	dfhyce.exe
File created	C:\Windows\SysWOW64\sgabbr.exe	yoxojq.exe
File opened for modification	C:\Windows\SysWOW64\flruud.exe	qwhwur.exe
File opened for modification	C:\Windows\SysWOW64\poudhi.exe	aknfkn.exe
File opened for modification	C:\Windows\SysWOW64\tboixg.exe	fptstc.exe
File created	C:\Windows\SysWOW64\tkggih.exe	hufayr.exe
File created	C:\Windows\SysWOW64\khpduq.exe	wciopv.exe
File created	C:\Windows\SysWOW64\qxujeq.exe	zqubgp.exe
File created	C:\Windows\SysWOW64\ofuclx.exe	uhdpon.exe
File opened for modification	C:\Windows\SysWOW64\fptstc.exe	lunszw.exe
File opened for modification	C:\Windows\SysWOW64\nsxvqv.exe	vzlnxv.exe
File opened for modification	C:\Windows\SysWOW64\emfwpg.exe	knojso.exe
File opened for modification	C:\Windows\SysWOW64\vjttvq.exe	jlrbcn.exe
File created	C:\Windows\SysWOW64\tboixg.exe	fptstc.exe
File opened for modification	C:\Windows\SysWOW64\aupguz.exe	gdybxp.exe
File created	C:\Windows\SysWOW64\prnhib.exe	gjfzja.exe
File opened for modification	C:\Windows\SysWOW64\khmofn.exe	tmptjj.exe
File created	C:\Windows\SysWOW64\fzdwvz.exe	orcowy.exe
File created	C:\Windows\SysWOW64\eozswi.exe	kblscc.exe
File created	C:\Windows\SysWOW64\qaijyi.exe	wnujec.exe
File created	C:\Windows\SysWOW64\tmptjj.exe	zqjlpd.exe
File created	C:\Windows\SysWOW64\ygbxxy.exe	hvqcwt.exe
File created	C:\Windows\SysWOW64\ifxafa.exe	rdmfev.exe
File opened for modification	C:\Windows\SysWOW64\zpujsj.exe	fzdwvz.exe
File opened for modification	C:\Windows\SysWOW64\pkerkr.exe	ydejmq.exe
File opened for modification	C:\Windows\SysWOW64\gjfzja.exe	pkerkr.exe
File opened for modification	C:\Windows\SysWOW64\ekxywd.exe	qcnvvd.exe
File opened for modification	C:\Windows\SysWOW64\khpduq.exe	wciopv.exe
File opened for modification	C:\Windows\SysWOW64\scpnyi.exe	gxzdyw.exe
File created	C:\Windows\SysWOW64\naycvr.exe	bqtwqk.exe
File created	C:\Windows\SysWOW64\prusux.exe	yktcvw.exe
File opened for modification	C:\Windows\SysWOW64\lxjoed.exe	ubutig.exe
File created	C:\Windows\SysWOW64\drhsnx.exe	msgkow.exe
File opened for modification	C:\Windows\SysWOW64\lsyuys.exe	xydfvp.exe
File opened for modification	C:\Windows\SysWOW64\yejyso.exe	gjudxs.exe
File opened for modification	C:\Windows\SysWOW64\nyytox.exe	duiqsa.exe
File opened for modification	C:\Windows\SysWOW64\qcnvvd.exe	hgqszz.exe
File opened for modification	C:\Windows\SysWOW64\duiqsa.exe	nsxvqv.exe
File created	C:\Windows\SysWOW64\fakftt.exe	oevdxo.exe
File opened for modification	C:\Windows\SysWOW64\jzgzhw.exe	ssfrio.exe
File created	C:\Windows\SysWOW64\jljpdl.exe	puscgb.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2400 set thread context of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2736 set thread context of 2688	2736	bljiez.exe	32
PID 2616 set thread context of 580	2616	hufayr.exe	34
PID 2164 set thread context of 1748	2164	tkggih.exe	36
PID 2872 set thread context of 1756	2872	mtydze.exe	38
PID 2676 set thread context of 2324	2676	ifstrx.exe	40
PID 1472 set thread context of 2092	1472	woiegd.exe	42
PID 1464 set thread context of 1640	1464	yfyrju.exe	44
PID 2516 set thread context of 2292	2516	wyfefw.exe	46
PID 2060 set thread context of 2844	2060	nmdsdo.exe	48
PID 2740 set thread context of 2604	2740	krjihq.exe	50
PID 3004 set thread context of 988	3004	qnrxar.exe	52
PID 1608 set thread context of 2212	1608	fomivh.exe	54
PID 2004 set thread context of 2040	2004	jmitcq.exe	56
PID 1744 set thread context of 2456	1744	khjlqm.exe	58
PID 2408 set thread context of 2276	2408	jlrbcn.exe	60
PID 552 set thread context of 1200	552	vjttvq.exe	62
PID 2500 set thread context of 2972	2500	tbsgrt.exe	64
PID 2168 set thread context of 1652	2168	derosq.exe	66
PID 1632 set thread context of 2804	1632	hggmcd.exe	68
PID 2692 set thread context of 2700	2692	qqumib.exe	70
PID 2640 set thread context of 772	2640	zlthse.exe	72
PID 984 set thread context of 1560	984	lnxnot.exe	74
PID 2888 set thread context of 1148	2888	xanfwf.exe	77
PID 2072 set thread context of 1696	2072	hgqszz.exe	79
PID 1048 set thread context of 2676	1048	qcnvvd.exe	81
PID 1472 set thread context of 1492	1472	ekxywd.exe	83
PID 1668 set thread context of 828	1668	wciopv.exe	85
PID 2304 set thread context of 2536	2304	khpduq.exe	87
PID 2384 set thread context of 2784	2384	ckegqv.exe	89
PID 2828 set thread context of 2704	2828	qwhwur.exe	91
PID 2636 set thread context of 2640	2636	flruud.exe	93
PID 1792 set thread context of 2436	1792	ryhmtp.exe	95
PID 1732 set thread context of 1980	1732	ifhusy.exe	97
PID 1940 set thread context of 1720	1940	xydfvp.exe	99
PID 1628 set thread context of 964	1628	lsyuys.exe	101
PID 1504 set thread context of 1284	1504	sttftb.exe	103
PID 1876 set thread context of 960	1876	gxzdyw.exe	105
PID 1888 set thread context of 2508	1888	scpnyi.exe	107
PID 868 set thread context of 2056	868	jgeqcn.exe	109
PID 2944 set thread context of 2608	2944	yowscm.exe	111
PID 2692 set thread context of 2744	2692	pjlvyj.exe	113
PID 2068 set thread context of 2012	2068	gjudxs.exe	115
PID 2540 set thread context of 2216	2540	yejyso.exe	117
PID 2228 set thread context of 2144	2228	pxvomo.exe	119
PID 2768 set thread context of 2136	2768	dqqexs.exe	121
PID 1472 set thread context of 2964	1472	yasrou.exe	123
PID 1804 set thread context of 1876	1804	bqtwqk.exe	125
PID 832 set thread context of 1928	832	naycvr.exe	127
PID 572 set thread context of 2968	572	cttmqi.exe	129
PID 2580 set thread context of 2596	2580	ogjfxu.exe	131
PID 2628 set thread context of 1688	2628	zwckik.exe	133
PID 2820 set thread context of 1308	2820	lghqes.exe	135
PID 1852 set thread context of 492	1852	aknfkn.exe	137
PID 1376 set thread context of 1036	1376	poudhi.exe	139
PID 2960 set thread context of 1868	2960	dtsbfd.exe	141
PID 2424 set thread context of 916	2424	sxzqly.exe	143
PID 1500 set thread context of 1276	1500	zqubgp.exe	145
PID 2492 set thread context of 376	2492	qxujeq.exe	147
PID 872 set thread context of 1624	872	hxdzdz.exe	149
PID 2812 set thread context of 868	2812	ypphwr.exe	151
PID 2788 set thread context of 1908	2788	qlekav.exe	153
PID 1216 set thread context of 568	1216	epkzxr.exe	155
PID 1768 set thread context of 1608	1768	sifpbm.exe	157

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qxujeq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlekav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jljpdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ydejmq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ygbxxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xhyfkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hggmcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pxvomo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcyguc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lunszw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nyytox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ygflyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bahvik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zaikem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prnhib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qwhwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kvkvnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yktcvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tboixg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stpxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcnvvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ktgsln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkerkr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xanfwf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yktcvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exgbug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xtdprf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jheuel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ufwpae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yejyso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwckik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lnxnot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifhusy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxzqly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sifpbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czvjfq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bljiez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	krjihq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lghqes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hjcosd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfrroi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xtdprf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfrroi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emtzbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fgttft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	naycvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ogjfxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poudhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecsxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgabbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sryrfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kvkvnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czvjfq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uvectn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eozswi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emfwpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gjfzja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jmitcq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ryhmtp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	orcowy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wciopv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scpnyi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	okluxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfajza.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2720	2400	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	30
PID 2720 wrote to memory of 2736	2720	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	31
PID 2720 wrote to memory of 2736	2720	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	31
PID 2720 wrote to memory of 2736	2720	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	31
PID 2720 wrote to memory of 2736	2720	f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe	31
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2736 wrote to memory of 2688	2736	bljiez.exe	32
PID 2688 wrote to memory of 2616	2688	bljiez.exe	33
PID 2688 wrote to memory of 2616	2688	bljiez.exe	33
PID 2688 wrote to memory of 2616	2688	bljiez.exe	33
PID 2688 wrote to memory of 2616	2688	bljiez.exe	33
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 2616 wrote to memory of 580	2616	hufayr.exe	34
PID 580 wrote to memory of 2164	580	hufayr.exe	35
PID 580 wrote to memory of 2164	580	hufayr.exe	35
PID 580 wrote to memory of 2164	580	hufayr.exe	35
PID 580 wrote to memory of 2164	580	hufayr.exe	35
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 2164 wrote to memory of 1748	2164	tkggih.exe	36
PID 1748 wrote to memory of 2872	1748	tkggih.exe	37
PID 1748 wrote to memory of 2872	1748	tkggih.exe	37
PID 1748 wrote to memory of 2872	1748	tkggih.exe	37
PID 1748 wrote to memory of 2872	1748	tkggih.exe	37
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38
PID 2872 wrote to memory of 1756	2872	mtydze.exe	38

C:\Users\Admin\AppData\Local\Temp\f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\bljiez.exe
    C:\Windows\system32\bljiez.exe 476 "C:\Users\Admin\AppData\Local\Temp\f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\SysWOW64\bljiez.exe
      C:\Windows\system32\bljiez.exe 476 "C:\Users\Admin\AppData\Local\Temp\f3a6663b8cb810e905ff5c7bed9ef67e_JaffaCakes118.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\hufayr.exe
        
        C:\Windows\system32\hufayr.exe 452 "C:\Windows\SysWOW64\bljiez.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\SysWOW64\hufayr.exe
        
        C:\Windows\system32\hufayr.exe 452 "C:\Windows\SysWOW64\bljiez.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:580
        
        C:\Windows\SysWOW64\tkggih.exe
        
        C:\Windows\system32\tkggih.exe 452 "C:\Windows\SysWOW64\hufayr.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\tkggih.exe
        
        C:\Windows\system32\tkggih.exe 452 "C:\Windows\SysWOW64\hufayr.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\SysWOW64\mtydze.exe
        
        C:\Windows\system32\mtydze.exe 452 "C:\Windows\SysWOW64\tkggih.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\mtydze.exe
        
        C:\Windows\system32\mtydze.exe 452 "C:\Windows\SysWOW64\tkggih.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1756
        
        C:\Windows\SysWOW64\ifstrx.exe
        
        C:\Windows\system32\ifstrx.exe 452 "C:\Windows\SysWOW64\mtydze.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2676
        
        C:\Windows\SysWOW64\ifstrx.exe
        
        C:\Windows\system32\ifstrx.exe 452 "C:\Windows\SysWOW64\mtydze.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2324
        
        C:\Windows\SysWOW64\woiegd.exe
        
        C:\Windows\system32\woiegd.exe 452 "C:\Windows\SysWOW64\ifstrx.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1472
        
        C:\Windows\SysWOW64\woiegd.exe
        
        C:\Windows\system32\woiegd.exe 452 "C:\Windows\SysWOW64\ifstrx.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\yfyrju.exe
        
        C:\Windows\system32\yfyrju.exe 452 "C:\Windows\SysWOW64\woiegd.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1464
        
        C:\Windows\SysWOW64\yfyrju.exe
        
        C:\Windows\system32\yfyrju.exe 452 "C:\Windows\SysWOW64\woiegd.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1640
        
        C:\Windows\SysWOW64\wyfefw.exe
        
        C:\Windows\system32\wyfefw.exe 452 "C:\Windows\SysWOW64\yfyrju.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2516
        
        C:\Windows\SysWOW64\wyfefw.exe
        
        C:\Windows\system32\wyfefw.exe 452 "C:\Windows\SysWOW64\yfyrju.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\nmdsdo.exe
        
        C:\Windows\system32\nmdsdo.exe 452 "C:\Windows\SysWOW64\wyfefw.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2060
        
        C:\Windows\SysWOW64\nmdsdo.exe
        
        C:\Windows\system32\nmdsdo.exe 452 "C:\Windows\SysWOW64\wyfefw.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2844
        
        C:\Windows\SysWOW64\krjihq.exe
        
        C:\Windows\system32\krjihq.exe 452 "C:\Windows\SysWOW64\nmdsdo.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Windows\SysWOW64\krjihq.exe
        
        C:\Windows\system32\krjihq.exe 452 "C:\Windows\SysWOW64\nmdsdo.exe"
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2604
        
        C:\Windows\SysWOW64\qnrxar.exe
        
        C:\Windows\system32\qnrxar.exe 452 "C:\Windows\SysWOW64\krjihq.exe"
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:3004
        
        C:\Windows\SysWOW64\qnrxar.exe
        
        C:\Windows\system32\qnrxar.exe 452 "C:\Windows\SysWOW64\krjihq.exe"
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:988
        
        C:\Windows\SysWOW64\fomivh.exe
        
        C:\Windows\system32\fomivh.exe 452 "C:\Windows\SysWOW64\qnrxar.exe"
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1608
        
        C:\Windows\SysWOW64\fomivh.exe
        
        C:\Windows\system32\fomivh.exe 452 "C:\Windows\SysWOW64\qnrxar.exe"
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2212
        
        C:\Windows\SysWOW64\jmitcq.exe
        
        C:\Windows\system32\jmitcq.exe 452 "C:\Windows\SysWOW64\fomivh.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2004
        
        C:\Windows\SysWOW64\jmitcq.exe
        
        C:\Windows\system32\jmitcq.exe 452 "C:\Windows\SysWOW64\fomivh.exe"
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Windows\SysWOW64\khjlqm.exe
        
        C:\Windows\system32\khjlqm.exe 452 "C:\Windows\SysWOW64\jmitcq.exe"
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1744
        
        C:\Windows\SysWOW64\khjlqm.exe
        
        C:\Windows\system32\khjlqm.exe 452 "C:\Windows\SysWOW64\jmitcq.exe"
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2456
        
        C:\Windows\SysWOW64\jlrbcn.exe
        
        C:\Windows\system32\jlrbcn.exe 452 "C:\Windows\SysWOW64\khjlqm.exe"
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2408
        
        C:\Windows\SysWOW64\jlrbcn.exe
        
        C:\Windows\system32\jlrbcn.exe 452 "C:\Windows\SysWOW64\khjlqm.exe"
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2276
        
        C:\Windows\SysWOW64\vjttvq.exe
        
        C:\Windows\system32\vjttvq.exe 452 "C:\Windows\SysWOW64\jlrbcn.exe"
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:552
        
        C:\Windows\SysWOW64\vjttvq.exe
        
        C:\Windows\system32\vjttvq.exe 452 "C:\Windows\SysWOW64\jlrbcn.exe"
        34⤵
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\tbsgrt.exe
        
        C:\Windows\system32\tbsgrt.exe 452 "C:\Windows\SysWOW64\vjttvq.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2500
        
        C:\Windows\SysWOW64\tbsgrt.exe
        
        C:\Windows\system32\tbsgrt.exe 452 "C:\Windows\SysWOW64\vjttvq.exe"
        36⤵
        Executes dropped EXE
        
        PID:2972
        
        C:\Windows\SysWOW64\derosq.exe
        
        C:\Windows\system32\derosq.exe 452 "C:\Windows\SysWOW64\tbsgrt.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2168
        
        C:\Windows\SysWOW64\derosq.exe
        
        C:\Windows\system32\derosq.exe 452 "C:\Windows\SysWOW64\tbsgrt.exe"
        38⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\hggmcd.exe
        
        C:\Windows\system32\hggmcd.exe 452 "C:\Windows\SysWOW64\derosq.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1632
        
        C:\Windows\SysWOW64\hggmcd.exe
        
        C:\Windows\system32\hggmcd.exe 452 "C:\Windows\SysWOW64\derosq.exe"
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\qqumib.exe
        
        C:\Windows\system32\qqumib.exe 452 "C:\Windows\SysWOW64\hggmcd.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2692
        
        C:\Windows\SysWOW64\qqumib.exe
        
        C:\Windows\system32\qqumib.exe 452 "C:\Windows\SysWOW64\hggmcd.exe"
        42⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\zlthse.exe
        
        C:\Windows\system32\zlthse.exe 452 "C:\Windows\SysWOW64\qqumib.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2640
        
        C:\Windows\SysWOW64\zlthse.exe
        
        C:\Windows\system32\zlthse.exe 452 "C:\Windows\SysWOW64\qqumib.exe"
        44⤵
        Executes dropped EXE
        
        PID:772
        
        C:\Windows\SysWOW64\lnxnot.exe
        
        C:\Windows\system32\lnxnot.exe 452 "C:\Windows\SysWOW64\zlthse.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:984
        
        C:\Windows\SysWOW64\lnxnot.exe
        
        C:\Windows\system32\lnxnot.exe 452 "C:\Windows\SysWOW64\zlthse.exe"
        46⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\xanfwf.exe
        
        C:\Windows\system32\xanfwf.exe 452 "C:\Windows\SysWOW64\lnxnot.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Windows\SysWOW64\xanfwf.exe
        
        C:\Windows\system32\xanfwf.exe 452 "C:\Windows\SysWOW64\lnxnot.exe"
        48⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\hgqszz.exe
        
        C:\Windows\system32\hgqszz.exe 452 "C:\Windows\SysWOW64\xanfwf.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2072
        
        C:\Windows\SysWOW64\hgqszz.exe
        
        C:\Windows\system32\hgqszz.exe 452 "C:\Windows\SysWOW64\xanfwf.exe"
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1696
        
        C:\Windows\SysWOW64\qcnvvd.exe
        
        C:\Windows\system32\qcnvvd.exe 452 "C:\Windows\SysWOW64\hgqszz.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1048
        
        C:\Windows\SysWOW64\qcnvvd.exe
        
        C:\Windows\system32\qcnvvd.exe 452 "C:\Windows\SysWOW64\hgqszz.exe"
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Windows\SysWOW64\ekxywd.exe
        
        C:\Windows\system32\ekxywd.exe 452 "C:\Windows\SysWOW64\qcnvvd.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1472
        
        C:\Windows\SysWOW64\ekxywd.exe
        
        C:\Windows\system32\ekxywd.exe 452 "C:\Windows\SysWOW64\qcnvvd.exe"
        54⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\wciopv.exe
        
        C:\Windows\system32\wciopv.exe 452 "C:\Windows\SysWOW64\ekxywd.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Windows\SysWOW64\wciopv.exe
        
        C:\Windows\system32\wciopv.exe 452 "C:\Windows\SysWOW64\ekxywd.exe"
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:828
        
        C:\Windows\SysWOW64\khpduq.exe
        
        C:\Windows\system32\khpduq.exe 452 "C:\Windows\SysWOW64\wciopv.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2304
        
        C:\Windows\SysWOW64\khpduq.exe
        
        C:\Windows\system32\khpduq.exe 452 "C:\Windows\SysWOW64\wciopv.exe"
        58⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\ckegqv.exe
        
        C:\Windows\system32\ckegqv.exe 452 "C:\Windows\SysWOW64\khpduq.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2384
        
        C:\Windows\SysWOW64\ckegqv.exe
        
        C:\Windows\system32\ckegqv.exe 452 "C:\Windows\SysWOW64\khpduq.exe"
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2784
        
        C:\Windows\SysWOW64\qwhwur.exe
        
        C:\Windows\system32\qwhwur.exe 452 "C:\Windows\SysWOW64\ckegqv.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Windows\SysWOW64\qwhwur.exe
        
        C:\Windows\system32\qwhwur.exe 452 "C:\Windows\SysWOW64\ckegqv.exe"
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2704
        
        C:\Windows\SysWOW64\flruud.exe
        
        C:\Windows\system32\flruud.exe 480 "C:\Windows\SysWOW64\qwhwur.exe"
        63⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2636
        
        C:\Windows\SysWOW64\flruud.exe
        
        C:\Windows\system32\flruud.exe 480 "C:\Windows\SysWOW64\qwhwur.exe"
        64⤵
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\SysWOW64\ryhmtp.exe
        
        C:\Windows\system32\ryhmtp.exe 452 "C:\Windows\SysWOW64\flruud.exe"
        65⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\ryhmtp.exe
        
        C:\Windows\system32\ryhmtp.exe 452 "C:\Windows\SysWOW64\flruud.exe"
        66⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\ifhusy.exe
        
        C:\Windows\system32\ifhusy.exe 452 "C:\Windows\SysWOW64\ryhmtp.exe"
        67⤵
        Suspicious use of SetThreadContext
        
        PID:1732
        
        C:\Windows\SysWOW64\ifhusy.exe
        
        C:\Windows\system32\ifhusy.exe 452 "C:\Windows\SysWOW64\ryhmtp.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Windows\SysWOW64\xydfvp.exe
        
        C:\Windows\system32\xydfvp.exe 452 "C:\Windows\SysWOW64\ifhusy.exe"
        69⤵
        Suspicious use of SetThreadContext
        
        PID:1940
        
        C:\Windows\SysWOW64\xydfvp.exe
        
        C:\Windows\system32\xydfvp.exe 452 "C:\Windows\SysWOW64\ifhusy.exe"
        70⤵
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\lsyuys.exe
        
        C:\Windows\system32\lsyuys.exe 496 "C:\Windows\SysWOW64\xydfvp.exe"
        71⤵
        Suspicious use of SetThreadContext
        
        PID:1628
        
        C:\Windows\SysWOW64\lsyuys.exe
        
        C:\Windows\system32\lsyuys.exe 496 "C:\Windows\SysWOW64\xydfvp.exe"
        72⤵
        Drops file in System32 directory
        
        PID:964
        
        C:\Windows\SysWOW64\sttftb.exe
        
        C:\Windows\system32\sttftb.exe 452 "C:\Windows\SysWOW64\lsyuys.exe"
        73⤵
        Suspicious use of SetThreadContext
        
        PID:1504
        
        C:\Windows\SysWOW64\sttftb.exe
        
        C:\Windows\system32\sttftb.exe 452 "C:\Windows\SysWOW64\lsyuys.exe"
        74⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\gxzdyw.exe
        
        C:\Windows\system32\gxzdyw.exe 452 "C:\Windows\SysWOW64\sttftb.exe"
        75⤵
        Suspicious use of SetThreadContext
        
        PID:1876
        
        C:\Windows\SysWOW64\gxzdyw.exe
        
        C:\Windows\system32\gxzdyw.exe 452 "C:\Windows\SysWOW64\sttftb.exe"
        76⤵
        Drops file in System32 directory
        
        PID:960
        
        C:\Windows\SysWOW64\scpnyi.exe
        
        C:\Windows\system32\scpnyi.exe 452 "C:\Windows\SysWOW64\gxzdyw.exe"
        77⤵
        Suspicious use of SetThreadContext
        
        PID:1888
        
        C:\Windows\SysWOW64\scpnyi.exe
        
        C:\Windows\system32\scpnyi.exe 452 "C:\Windows\SysWOW64\gxzdyw.exe"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Windows\SysWOW64\jgeqcn.exe
        
        C:\Windows\system32\jgeqcn.exe 452 "C:\Windows\SysWOW64\scpnyi.exe"
        79⤵
        Suspicious use of SetThreadContext
        
        PID:868
        
        C:\Windows\SysWOW64\jgeqcn.exe
        
        C:\Windows\system32\jgeqcn.exe 452 "C:\Windows\SysWOW64\scpnyi.exe"
        80⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\yowscm.exe
        
        C:\Windows\system32\yowscm.exe 452 "C:\Windows\SysWOW64\jgeqcn.exe"
        81⤵
        Suspicious use of SetThreadContext
        
        PID:2944
        
        C:\Windows\SysWOW64\yowscm.exe
        
        C:\Windows\system32\yowscm.exe 452 "C:\Windows\SysWOW64\jgeqcn.exe"
        82⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\pjlvyj.exe
        
        C:\Windows\system32\pjlvyj.exe 452 "C:\Windows\SysWOW64\yowscm.exe"
        83⤵
        Suspicious use of SetThreadContext
        
        PID:2692
        
        C:\Windows\SysWOW64\pjlvyj.exe
        
        C:\Windows\system32\pjlvyj.exe 452 "C:\Windows\SysWOW64\yowscm.exe"
        84⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\gjudxs.exe
        
        C:\Windows\system32\gjudxs.exe 452 "C:\Windows\SysWOW64\pjlvyj.exe"
        85⤵
        Suspicious use of SetThreadContext
        
        PID:2068
        
        C:\Windows\SysWOW64\gjudxs.exe
        
        C:\Windows\system32\gjudxs.exe 452 "C:\Windows\SysWOW64\pjlvyj.exe"
        86⤵
        Drops file in System32 directory
        
        PID:2012
        
        C:\Windows\SysWOW64\yejyso.exe
        
        C:\Windows\system32\yejyso.exe 452 "C:\Windows\SysWOW64\gjudxs.exe"
        87⤵
        Suspicious use of SetThreadContext
        
        PID:2540
        
        C:\Windows\SysWOW64\yejyso.exe
        
        C:\Windows\system32\yejyso.exe 452 "C:\Windows\SysWOW64\gjudxs.exe"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Windows\SysWOW64\pxvomo.exe
        
        C:\Windows\system32\pxvomo.exe 452 "C:\Windows\SysWOW64\yejyso.exe"
        89⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Windows\SysWOW64\pxvomo.exe
        
        C:\Windows\system32\pxvomo.exe 452 "C:\Windows\SysWOW64\yejyso.exe"
        90⤵
        Drops file in System32 directory
        
        PID:2144
        
        C:\Windows\SysWOW64\dqqexs.exe
        
        C:\Windows\system32\dqqexs.exe 452 "C:\Windows\SysWOW64\pxvomo.exe"
        91⤵
        Suspicious use of SetThreadContext
        
        PID:2768
        
        C:\Windows\SysWOW64\dqqexs.exe
        
        C:\Windows\system32\dqqexs.exe 452 "C:\Windows\SysWOW64\pxvomo.exe"
        92⤵
        Drops file in System32 directory
        
        PID:2136
        
        C:\Windows\SysWOW64\yasrou.exe
        
        C:\Windows\system32\yasrou.exe 452 "C:\Windows\SysWOW64\dqqexs.exe"
        93⤵
        Suspicious use of SetThreadContext
        
        PID:1472
        
        C:\Windows\SysWOW64\yasrou.exe
        
        C:\Windows\system32\yasrou.exe 452 "C:\Windows\SysWOW64\dqqexs.exe"
        94⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\bqtwqk.exe
        
        C:\Windows\system32\bqtwqk.exe 452 "C:\Windows\SysWOW64\yasrou.exe"
        95⤵
        Suspicious use of SetThreadContext
        
        PID:1804
        
        C:\Windows\SysWOW64\bqtwqk.exe
        
        C:\Windows\system32\bqtwqk.exe 452 "C:\Windows\SysWOW64\yasrou.exe"
        96⤵
        Drops file in System32 directory
        
        PID:1876
        
        C:\Windows\SysWOW64\naycvr.exe
        
        C:\Windows\system32\naycvr.exe 452 "C:\Windows\SysWOW64\bqtwqk.exe"
        97⤵
        Suspicious use of SetThreadContext
        
        PID:832
        
        C:\Windows\SysWOW64\naycvr.exe
        
        C:\Windows\system32\naycvr.exe 452 "C:\Windows\SysWOW64\bqtwqk.exe"
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        C:\Windows\SysWOW64\cttmqi.exe
        
        C:\Windows\system32\cttmqi.exe 476 "C:\Windows\SysWOW64\naycvr.exe"
        99⤵
        Suspicious use of SetThreadContext
        
        PID:572
        
        C:\Windows\SysWOW64\cttmqi.exe
        
        C:\Windows\system32\cttmqi.exe 476 "C:\Windows\SysWOW64\naycvr.exe"
        100⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\ogjfxu.exe
        
        C:\Windows\system32\ogjfxu.exe 452 "C:\Windows\SysWOW64\cttmqi.exe"
        101⤵
        Suspicious use of SetThreadContext
        
        PID:2580
        
        C:\Windows\SysWOW64\ogjfxu.exe
        
        C:\Windows\system32\ogjfxu.exe 452 "C:\Windows\SysWOW64\cttmqi.exe"
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Windows\SysWOW64\zwckik.exe
        
        C:\Windows\system32\zwckik.exe 452 "C:\Windows\SysWOW64\ogjfxu.exe"
        103⤵
        Suspicious use of SetThreadContext
        
        PID:2628
        
        C:\Windows\SysWOW64\zwckik.exe
        
        C:\Windows\system32\zwckik.exe 452 "C:\Windows\SysWOW64\ogjfxu.exe"
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Windows\SysWOW64\lghqes.exe
        
        C:\Windows\system32\lghqes.exe 452 "C:\Windows\SysWOW64\zwckik.exe"
        105⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\lghqes.exe
        
        C:\Windows\system32\lghqes.exe 452 "C:\Windows\SysWOW64\zwckik.exe"
        106⤵
        Drops file in System32 directory
        
        PID:1308
        
        C:\Windows\SysWOW64\aknfkn.exe
        
        C:\Windows\system32\aknfkn.exe 452 "C:\Windows\SysWOW64\lghqes.exe"
        107⤵
        Suspicious use of SetThreadContext
        
        PID:1852
        
        C:\Windows\SysWOW64\aknfkn.exe
        
        C:\Windows\system32\aknfkn.exe 452 "C:\Windows\SysWOW64\lghqes.exe"
        108⤵
        Drops file in System32 directory
        
        PID:492
        
        C:\Windows\SysWOW64\poudhi.exe
        
        C:\Windows\system32\poudhi.exe 452 "C:\Windows\SysWOW64\aknfkn.exe"
        109⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Windows\SysWOW64\poudhi.exe
        
        C:\Windows\system32\poudhi.exe 452 "C:\Windows\SysWOW64\aknfkn.exe"
        110⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\dtsbfd.exe
        
        C:\Windows\system32\dtsbfd.exe 452 "C:\Windows\SysWOW64\poudhi.exe"
        111⤵
        Suspicious use of SetThreadContext
        
        PID:2960
        
        C:\Windows\SysWOW64\dtsbfd.exe
        
        C:\Windows\system32\dtsbfd.exe 452 "C:\Windows\SysWOW64\poudhi.exe"
        112⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\sxzqly.exe
        
        C:\Windows\system32\sxzqly.exe 452 "C:\Windows\SysWOW64\dtsbfd.exe"
        113⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\sxzqly.exe
        
        C:\Windows\system32\sxzqly.exe 452 "C:\Windows\SysWOW64\dtsbfd.exe"
        114⤵
        
        PID:916
        
        C:\Windows\SysWOW64\zqubgp.exe
        
        C:\Windows\system32\zqubgp.exe 452 "C:\Windows\SysWOW64\sxzqly.exe"
        115⤵
        Suspicious use of SetThreadContext
        
        PID:1500
        
        C:\Windows\SysWOW64\zqubgp.exe
        
        C:\Windows\system32\zqubgp.exe 452 "C:\Windows\SysWOW64\sxzqly.exe"
        116⤵
        Drops file in System32 directory
        
        PID:1276
        
        C:\Windows\SysWOW64\qxujeq.exe
        
        C:\Windows\system32\qxujeq.exe 452 "C:\Windows\SysWOW64\zqubgp.exe"
        117⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Windows\SysWOW64\qxujeq.exe
        
        C:\Windows\system32\qxujeq.exe 452 "C:\Windows\SysWOW64\zqubgp.exe"
        118⤵
        
        PID:376
        
        C:\Windows\SysWOW64\hxdzdz.exe
        
        C:\Windows\system32\hxdzdz.exe 452 "C:\Windows\SysWOW64\qxujeq.exe"
        119⤵
        Suspicious use of SetThreadContext
        
        PID:872
        
        C:\Windows\SysWOW64\hxdzdz.exe
        
        C:\Windows\system32\hxdzdz.exe 452 "C:\Windows\SysWOW64\qxujeq.exe"
        120⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\ypphwr.exe
        
        C:\Windows\system32\ypphwr.exe 452 "C:\Windows\SysWOW64\hxdzdz.exe"
        121⤵
        Suspicious use of SetThreadContext
        
        PID:2812
        
        C:\Windows\SysWOW64\ypphwr.exe
        
        C:\Windows\system32\ypphwr.exe 452 "C:\Windows\SysWOW64\hxdzdz.exe"
        122⤵
        
        PID:868
        
        C:\Windows\SysWOW64\qlekav.exe
        
        C:\Windows\system32\qlekav.exe 452 "C:\Windows\SysWOW64\ypphwr.exe"
        123⤵
        Suspicious use of SetThreadContext
        
        PID:2788
        
        C:\Windows\SysWOW64\qlekav.exe
        
        C:\Windows\system32\qlekav.exe 452 "C:\Windows\SysWOW64\ypphwr.exe"
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Windows\SysWOW64\epkzxr.exe
        
        C:\Windows\system32\epkzxr.exe 452 "C:\Windows\SysWOW64\qlekav.exe"
        125⤵
        Suspicious use of SetThreadContext
        
        PID:1216
        
        C:\Windows\SysWOW64\epkzxr.exe
        
        C:\Windows\system32\epkzxr.exe 452 "C:\Windows\SysWOW64\qlekav.exe"
        126⤵
        Drops file in System32 directory
        
        PID:568
        
        C:\Windows\SysWOW64\sifpbm.exe
        
        C:\Windows\system32\sifpbm.exe 452 "C:\Windows\SysWOW64\epkzxr.exe"
        127⤵
        Suspicious use of SetThreadContext
        
        PID:1768
        
        C:\Windows\SysWOW64\sifpbm.exe
        
        C:\Windows\system32\sifpbm.exe 452 "C:\Windows\SysWOW64\epkzxr.exe"
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\kecsxr.exe
        
        C:\Windows\system32\kecsxr.exe 452 "C:\Windows\SysWOW64\sifpbm.exe"
        129⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\kecsxr.exe
        
        C:\Windows\system32\kecsxr.exe 452 "C:\Windows\SysWOW64\sifpbm.exe"
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:984
        
        C:\Windows\SysWOW64\basnao.exe
        
        C:\Windows\system32\basnao.exe 452 "C:\Windows\SysWOW64\kecsxr.exe"
        131⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\basnao.exe
        
        C:\Windows\system32\basnao.exe 452 "C:\Windows\SysWOW64\kecsxr.exe"
        132⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\swpqws.exe
        
        C:\Windows\system32\swpqws.exe 452 "C:\Windows\SysWOW64\basnao.exe"
        133⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\swpqws.exe
        
        C:\Windows\system32\swpqws.exe 452 "C:\Windows\SysWOW64\basnao.exe"
        134⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\kvpyvt.exe
        
        C:\Windows\system32\kvpyvt.exe 452 "C:\Windows\SysWOW64\swpqws.exe"
        135⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\kvpyvt.exe
        
        C:\Windows\system32\kvpyvt.exe 452 "C:\Windows\SysWOW64\swpqws.exe"
        136⤵
        Drops file in System32 directory
        
        PID:1860
        
        C:\Windows\SysWOW64\tcyguc.exe
        
        C:\Windows\system32\tcyguc.exe 452 "C:\Windows\SysWOW64\kvpyvt.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
        
        C:\Windows\SysWOW64\tcyguc.exe
        
        C:\Windows\system32\tcyguc.exe 452 "C:\Windows\SysWOW64\kvpyvt.exe"
        138⤵
        
        PID:896
        
        C:\Windows\SysWOW64\kvkvnc.exe
        
        C:\Windows\system32\kvkvnc.exe 452 "C:\Windows\SysWOW64\tcyguc.exe"
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Windows\SysWOW64\kvkvnc.exe
        
        C:\Windows\system32\kvkvnc.exe 452 "C:\Windows\SysWOW64\tcyguc.exe"
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:284
        
        C:\Windows\SysWOW64\ygflyy.exe
        
        C:\Windows\system32\ygflyy.exe 452 "C:\Windows\SysWOW64\kvkvnc.exe"
        141⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\ygflyy.exe
        
        C:\Windows\system32\ygflyy.exe 452 "C:\Windows\SysWOW64\kvkvnc.exe"
        142⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        C:\Windows\SysWOW64\tqhyhh.exe
        
        C:\Windows\system32\tqhyhh.exe 452 "C:\Windows\SysWOW64\ygflyy.exe"
        143⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\tqhyhh.exe
        
        C:\Windows\system32\tqhyhh.exe 452 "C:\Windows\SysWOW64\ygflyy.exe"
        144⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\hjcosd.exe
        
        C:\Windows\system32\hjcosd.exe 452 "C:\Windows\SysWOW64\tqhyhh.exe"
        145⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\hjcosd.exe
        
        C:\Windows\system32\hjcosd.exe 452 "C:\Windows\SysWOW64\tqhyhh.exe"
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\yfrroi.exe
        
        C:\Windows\system32\yfrroi.exe 452 "C:\Windows\SysWOW64\hjcosd.exe"
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\yfrroi.exe
        
        C:\Windows\system32\yfrroi.exe 452 "C:\Windows\SysWOW64\hjcosd.exe"
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
        
        C:\Windows\SysWOW64\ssfrio.exe
        
        C:\Windows\system32\ssfrio.exe 452 "C:\Windows\SysWOW64\yfrroi.exe"
        149⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\ssfrio.exe
        
        C:\Windows\system32\ssfrio.exe 452 "C:\Windows\SysWOW64\yfrroi.exe"
        150⤵
        Drops file in System32 directory
        
        PID:1584
        
        C:\Windows\SysWOW64\jzgzhw.exe
        
        C:\Windows\system32\jzgzhw.exe 452 "C:\Windows\SysWOW64\ssfrio.exe"
        151⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\jzgzhw.exe
        
        C:\Windows\system32\jzgzhw.exe 452 "C:\Windows\SysWOW64\ssfrio.exe"
        152⤵
        Drops file in System32 directory
        
        PID:2248
        
        C:\Windows\SysWOW64\emtzbc.exe
        
        C:\Windows\system32\emtzbc.exe 452 "C:\Windows\SysWOW64\jzgzhw.exe"
        153⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\emtzbc.exe
        
        C:\Windows\system32\emtzbc.exe 452 "C:\Windows\SysWOW64\jzgzhw.exe"
        154⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:864
        
        C:\Windows\SysWOW64\uxfuci.exe
        
        C:\Windows\system32\uxfuci.exe 452 "C:\Windows\SysWOW64\emtzbc.exe"
        155⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\uxfuci.exe
        
        C:\Windows\system32\uxfuci.exe 452 "C:\Windows\SysWOW64\emtzbc.exe"
        156⤵
        
        PID:908
        
        C:\Windows\SysWOW64\okluxn.exe
        
        C:\Windows\system32\okluxn.exe 452 "C:\Windows\SysWOW64\uxfuci.exe"
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
        
        C:\Windows\SysWOW64\okluxn.exe
        
        C:\Windows\system32\okluxn.exe 452 "C:\Windows\SysWOW64\uxfuci.exe"
        158⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\yktcvw.exe
        
        C:\Windows\system32\yktcvw.exe 452 "C:\Windows\SysWOW64\okluxn.exe"
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Windows\SysWOW64\yktcvw.exe
        
        C:\Windows\system32\yktcvw.exe 452 "C:\Windows\SysWOW64\okluxn.exe"
        160⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Windows\SysWOW64\prusux.exe
        
        C:\Windows\system32\prusux.exe 452 "C:\Windows\SysWOW64\yktcvw.exe"
        161⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\prusux.exe
        
        C:\Windows\system32\prusux.exe 452 "C:\Windows\SysWOW64\yktcvw.exe"
        162⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\gquabg.exe
        
        C:\Windows\system32\gquabg.exe 452 "C:\Windows\SysWOW64\prusux.exe"
        163⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\gquabg.exe
        
        C:\Windows\system32\gquabg.exe 452 "C:\Windows\SysWOW64\prusux.exe"
        164⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\xmrvwd.exe
        
        C:\Windows\system32\xmrvwd.exe 452 "C:\Windows\SysWOW64\gquabg.exe"
        165⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\xmrvwd.exe
        
        C:\Windows\system32\xmrvwd.exe 452 "C:\Windows\SysWOW64\gquabg.exe"
        166⤵
        Drops file in System32 directory
        
        PID:2732
        
        C:\Windows\SysWOW64\oipysh.exe
        
        C:\Windows\system32\oipysh.exe 452 "C:\Windows\SysWOW64\xmrvwd.exe"
        167⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\oipysh.exe
        
        C:\Windows\system32\oipysh.exe 452 "C:\Windows\SysWOW64\xmrvwd.exe"
        168⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\jduymn.exe
        
        C:\Windows\system32\jduymn.exe 452 "C:\Windows\SysWOW64\oipysh.exe"
        169⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\jduymn.exe
        
        C:\Windows\system32\jduymn.exe 452 "C:\Windows\SysWOW64\oipysh.exe"
        170⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\zggtoa.exe
        
        C:\Windows\system32\zggtoa.exe 452 "C:\Windows\SysWOW64\jduymn.exe"
        171⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\zggtoa.exe
        
        C:\Windows\system32\zggtoa.exe 452 "C:\Windows\SysWOW64\jduymn.exe"
        172⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\ubutig.exe
        
        C:\Windows\system32\ubutig.exe 452 "C:\Windows\SysWOW64\zggtoa.exe"
        173⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\ubutig.exe
        
        C:\Windows\system32\ubutig.exe 452 "C:\Windows\SysWOW64\zggtoa.exe"
        174⤵
        Drops file in System32 directory
        
        PID:2180
        
        C:\Windows\SysWOW64\lxjoed.exe
        
        C:\Windows\system32\lxjoed.exe 452 "C:\Windows\SysWOW64\ubutig.exe"
        175⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\lxjoed.exe
        
        C:\Windows\system32\lxjoed.exe 452 "C:\Windows\SysWOW64\ubutig.exe"
        176⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\czvjfq.exe
        
        C:\Windows\system32\czvjfq.exe 452 "C:\Windows\SysWOW64\lxjoed.exe"
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:608
        
        C:\Windows\SysWOW64\czvjfq.exe
        
        C:\Windows\system32\czvjfq.exe 452 "C:\Windows\SysWOW64\lxjoed.exe"
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Windows\SysWOW64\wvjjzw.exe
        
        C:\Windows\system32\wvjjzw.exe 452 "C:\Windows\SysWOW64\czvjfq.exe"
        179⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\wvjjzw.exe
        
        C:\Windows\system32\wvjjzw.exe 452 "C:\Windows\SysWOW64\czvjfq.exe"
        180⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\nqgmva.exe
        
        C:\Windows\system32\nqgmva.exe 452 "C:\Windows\SysWOW64\wvjjzw.exe"
        181⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\nqgmva.exe
        
        C:\Windows\system32\nqgmva.exe 452 "C:\Windows\SysWOW64\wvjjzw.exe"
        182⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\uvectn.exe
        
        C:\Windows\system32\uvectn.exe 452 "C:\Windows\SysWOW64\nqgmva.exe"
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\uvectn.exe
        
        C:\Windows\system32\uvectn.exe 452 "C:\Windows\SysWOW64\nqgmva.exe"
        184⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\lunszw.exe
        
        C:\Windows\system32\lunszw.exe 452 "C:\Windows\SysWOW64\uvectn.exe"
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\lunszw.exe
        
        C:\Windows\system32\lunszw.exe 452 "C:\Windows\SysWOW64\uvectn.exe"
        186⤵
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\fptstc.exe
        
        C:\Windows\system32\fptstc.exe 452 "C:\Windows\SysWOW64\lunszw.exe"
        187⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\fptstc.exe
        
        C:\Windows\system32\fptstc.exe 452 "C:\Windows\SysWOW64\lunszw.exe"
        188⤵
        Drops file in System32 directory
        
        PID:2100
        
        C:\Windows\SysWOW64\tboixg.exe
        
        C:\Windows\system32\tboixg.exe 452 "C:\Windows\SysWOW64\fptstc.exe"
        189⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\tboixg.exe
        
        C:\Windows\system32\tboixg.exe 452 "C:\Windows\SysWOW64\fptstc.exe"
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
        
        C:\Windows\SysWOW64\nocirm.exe
        
        C:\Windows\system32\nocirm.exe 452 "C:\Windows\SysWOW64\tboixg.exe"
        191⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\nocirm.exe
        
        C:\Windows\system32\nocirm.exe 452 "C:\Windows\SysWOW64\tboixg.exe"
        192⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\hjhils.exe
        
        C:\Windows\system32\hjhils.exe 452 "C:\Windows\SysWOW64\nocirm.exe"
        193⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\hjhils.exe
        
        C:\Windows\system32\hjhils.exe 452 "C:\Windows\SysWOW64\nocirm.exe"
        194⤵
        
        PID:672
        
        C:\Windows\SysWOW64\bahvik.exe
        
        C:\Windows\system32\bahvik.exe 452 "C:\Windows\SysWOW64\hjhils.exe"
        195⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\bahvik.exe
        
        C:\Windows\system32\bahvik.exe 452 "C:\Windows\SysWOW64\hjhils.exe"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\shhdgl.exe
        
        C:\Windows\system32\shhdgl.exe 452 "C:\Windows\SysWOW64\bahvik.exe"
        197⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\shhdgl.exe
        
        C:\Windows\system32\shhdgl.exe 452 "C:\Windows\SysWOW64\bahvik.exe"
        198⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\jktyiq.exe
        
        C:\Windows\system32\jktyiq.exe 452 "C:\Windows\SysWOW64\shhdgl.exe"
        199⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\jktyiq.exe
        
        C:\Windows\system32\jktyiq.exe 452 "C:\Windows\SysWOW64\shhdgl.exe"
        200⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\dfhyce.exe
        
        C:\Windows\system32\dfhyce.exe 452 "C:\Windows\SysWOW64\jktyiq.exe"
        201⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\dfhyce.exe
        
        C:\Windows\system32\dfhyce.exe 452 "C:\Windows\SysWOW64\jktyiq.exe"
        202⤵
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\xsmgwk.exe
        
        C:\Windows\system32\xsmgwk.exe 476 "C:\Windows\SysWOW64\dfhyce.exe"
        203⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\xsmgwk.exe
        
        C:\Windows\system32\xsmgwk.exe 476 "C:\Windows\SysWOW64\dfhyce.exe"
        204⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\gdybxp.exe
        
        C:\Windows\system32\gdybxp.exe 452 "C:\Windows\SysWOW64\xsmgwk.exe"
        205⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\gdybxp.exe
        
        C:\Windows\system32\gdybxp.exe 452 "C:\Windows\SysWOW64\xsmgwk.exe"
        206⤵
        Drops file in System32 directory
        
        PID:2800
        
        C:\Windows\SysWOW64\aupguz.exe
        
        C:\Windows\system32\aupguz.exe 452 "C:\Windows\SysWOW64\gdybxp.exe"
        207⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\aupguz.exe
        
        C:\Windows\system32\aupguz.exe 452 "C:\Windows\SysWOW64\gdybxp.exe"
        208⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\uhdpon.exe
        
        C:\Windows\system32\uhdpon.exe 452 "C:\Windows\SysWOW64\aupguz.exe"
        209⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\uhdpon.exe
        
        C:\Windows\system32\uhdpon.exe 452 "C:\Windows\SysWOW64\aupguz.exe"
        210⤵
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\ofuclx.exe
        
        C:\Windows\system32\ofuclx.exe 452 "C:\Windows\SysWOW64\uhdpon.exe"
        211⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\ofuclx.exe
        
        C:\Windows\system32\ofuclx.exe 452 "C:\Windows\SysWOW64\uhdpon.exe"
        212⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\fqgpmd.exe
        
        C:\Windows\system32\fqgpmd.exe 452 "C:\Windows\SysWOW64\ofuclx.exe"
        213⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\fqgpmd.exe
        
        C:\Windows\system32\fqgpmd.exe 452 "C:\Windows\SysWOW64\ofuclx.exe"
        214⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\zaikem.exe
        
        C:\Windows\system32\zaikem.exe 452 "C:\Windows\SysWOW64\fqgpmd.exe"
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:876
        
        C:\Windows\SysWOW64\zaikem.exe
        
        C:\Windows\system32\zaikem.exe 452 "C:\Windows\SysWOW64\fqgpmd.exe"
        216⤵
        
        PID:832
        
        C:\Windows\SysWOW64\qduffr.exe
        
        C:\Windows\system32\qduffr.exe 452 "C:\Windows\SysWOW64\zaikem.exe"
        217⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\qduffr.exe
        
        C:\Windows\system32\qduffr.exe 452 "C:\Windows\SysWOW64\zaikem.exe"
        218⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\kblscc.exe
        
        C:\Windows\system32\kblscc.exe 452 "C:\Windows\SysWOW64\qduffr.exe"
        219⤵
        
        PID:872
        
        C:\Windows\SysWOW64\kblscc.exe
        
        C:\Windows\system32\kblscc.exe 452 "C:\Windows\SysWOW64\qduffr.exe"
        220⤵
        Drops file in System32 directory
        
        PID:2568
        
        C:\Windows\SysWOW64\eozswi.exe
        
        C:\Windows\system32\eozswi.exe 452 "C:\Windows\SysWOW64\kblscc.exe"
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Windows\SysWOW64\eozswi.exe
        
        C:\Windows\system32\eozswi.exe 452 "C:\Windows\SysWOW64\kblscc.exe"
        222⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\vzlnxv.exe
        
        C:\Windows\system32\vzlnxv.exe 452 "C:\Windows\SysWOW64\eozswi.exe"
        223⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\vzlnxv.exe
        
        C:\Windows\system32\vzlnxv.exe 452 "C:\Windows\SysWOW64\eozswi.exe"
        224⤵
        Drops file in System32 directory
        
        PID:592
        
        C:\Windows\SysWOW64\nsxvqv.exe
        
        C:\Windows\system32\nsxvqv.exe 452 "C:\Windows\SysWOW64\vzlnxv.exe"
        225⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\nsxvqv.exe
        
        C:\Windows\system32\nsxvqv.exe 452 "C:\Windows\SysWOW64\vzlnxv.exe"
        226⤵
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\duiqsa.exe
        
        C:\Windows\system32\duiqsa.exe 452 "C:\Windows\SysWOW64\nsxvqv.exe"
        227⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\duiqsa.exe
        
        C:\Windows\system32\duiqsa.exe 452 "C:\Windows\SysWOW64\nsxvqv.exe"
        228⤵
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\nyytox.exe
        
        C:\Windows\system32\nyytox.exe 452 "C:\Windows\SysWOW64\duiqsa.exe"
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\nyytox.exe
        
        C:\Windows\system32\nyytox.exe 452 "C:\Windows\SysWOW64\duiqsa.exe"
        230⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\exgbug.exe
        
        C:\Windows\system32\exgbug.exe 452 "C:\Windows\SysWOW64\nyytox.exe"
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Windows\SysWOW64\exgbug.exe
        
        C:\Windows\system32\exgbug.exe 452 "C:\Windows\SysWOW64\nyytox.exe"
        232⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\yoxojq.exe
        
        C:\Windows\system32\yoxojq.exe 452 "C:\Windows\SysWOW64\exgbug.exe"
        233⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\yoxojq.exe
        
        C:\Windows\system32\yoxojq.exe 452 "C:\Windows\SysWOW64\exgbug.exe"
        234⤵
        Drops file in System32 directory
        
        PID:1808
        
        C:\Windows\SysWOW64\sgabbr.exe
        
        C:\Windows\system32\sgabbr.exe 452 "C:\Windows\SysWOW64\yoxojq.exe"
        235⤵
        
        PID:352
        
        C:\Windows\SysWOW64\sgabbr.exe
        
        C:\Windows\system32\sgabbr.exe 452 "C:\Windows\SysWOW64\yoxojq.exe"
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Windows\SysWOW64\jfajza.exe
        
        C:\Windows\system32\jfajza.exe 452 "C:\Windows\SysWOW64\sgabbr.exe"
        237⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\jfajza.exe
        
        C:\Windows\system32\jfajza.exe 452 "C:\Windows\SysWOW64\sgabbr.exe"
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Windows\SysWOW64\aqmejf.exe
        
        C:\Windows\system32\aqmejf.exe 452 "C:\Windows\SysWOW64\jfajza.exe"
        239⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\aqmejf.exe
        
        C:\Windows\system32\aqmejf.exe 452 "C:\Windows\SysWOW64\jfajza.exe"
        240⤵
        
        PID:596
        
        C:\Windows\SysWOW64\puscgb.exe
        
        C:\Windows\system32\puscgb.exe 452 "C:\Windows\SysWOW64\aqmejf.exe"
        241⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\puscgb.exe
        
        C:\Windows\system32\puscgb.exe 452 "C:\Windows\SysWOW64\aqmejf.exe"
        242⤵
        Drops file in System32 directory
        
        PID:3020
        
        C:\Windows\SysWOW64\jljpdl.exe
        
        C:\Windows\system32\jljpdl.exe 452 "C:\Windows\SysWOW64\puscgb.exe"
        243⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\jljpdl.exe
        
        C:\Windows\system32\jljpdl.exe 452 "C:\Windows\SysWOW64\puscgb.exe"
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Windows\SysWOW64\dyxpxz.exe
        
        C:\Windows\system32\dyxpxz.exe 452 "C:\Windows\SysWOW64\jljpdl.exe"
        245⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\dyxpxz.exe
        
        C:\Windows\system32\dyxpxz.exe 452 "C:\Windows\SysWOW64\jljpdl.exe"
        246⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\xtdprf.exe
        
        C:\Windows\system32\xtdprf.exe 452 "C:\Windows\SysWOW64\dyxpxz.exe"
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
        
        C:\Windows\SysWOW64\xtdprf.exe
        
        C:\Windows\system32\xtdprf.exe 452 "C:\Windows\SysWOW64\dyxpxz.exe"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Windows\SysWOW64\owpktk.exe
        
        C:\Windows\system32\owpktk.exe 452 "C:\Windows\SysWOW64\xtdprf.exe"
        249⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\owpktk.exe
        
        C:\Windows\system32\owpktk.exe 452 "C:\Windows\SysWOW64\xtdprf.exe"
        250⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\ardknq.exe
        
        C:\Windows\system32\ardknq.exe 452 "C:\Windows\SysWOW64\owpktk.exe"
        251⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\ardknq.exe
        
        C:\Windows\system32\ardknq.exe 452 "C:\Windows\SysWOW64\owpktk.exe"
        252⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\uiuyki.exe
        
        C:\Windows\system32\uiuyki.exe 452 "C:\Windows\SysWOW64\ardknq.exe"
        253⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\uiuyki.exe
        
        C:\Windows\system32\uiuyki.exe 452 "C:\Windows\SysWOW64\ardknq.exe"
        254⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\ktgsln.exe
        
        C:\Windows\system32\ktgsln.exe 452 "C:\Windows\SysWOW64\uiuyki.exe"
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Windows\SysWOW64\ktgsln.exe
        
        C:\Windows\system32\ktgsln.exe 452 "C:\Windows\SysWOW64\uiuyki.exe"
        256⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\fgttft.exe
        
        C:\Windows\system32\fgttft.exe 452 "C:\Windows\SysWOW64\ktgsln.exe"
        257⤵
        
        PID:336
        
        C:\Windows\SysWOW64\fgttft.exe
        
        C:\Windows\system32\fgttft.exe 452 "C:\Windows\SysWOW64\ktgsln.exe"
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\wnujec.exe
        
        C:\Windows\system32\wnujec.exe 452 "C:\Windows\SysWOW64\fgttft.exe"
        259⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\wnujec.exe
        
        C:\Windows\system32\wnujec.exe 452 "C:\Windows\SysWOW64\fgttft.exe"
        260⤵
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\qaijyi.exe
        
        C:\Windows\system32\qaijyi.exe 452 "C:\Windows\SysWOW64\wnujec.exe"
        261⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\qaijyi.exe
        
        C:\Windows\system32\qaijyi.exe 452 "C:\Windows\SysWOW64\wnujec.exe"
        262⤵
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\knojso.exe
        
        C:\Windows\system32\knojso.exe 452 "C:\Windows\SysWOW64\qaijyi.exe"
        263⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\knojso.exe
        
        C:\Windows\system32\knojso.exe 452 "C:\Windows\SysWOW64\qaijyi.exe"
        264⤵
        Drops file in System32 directory
        
        PID:1292
        
        C:\Windows\SysWOW64\emfwpg.exe
        
        C:\Windows\system32\emfwpg.exe 452 "C:\Windows\SysWOW64\knojso.exe"
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Windows\SysWOW64\emfwpg.exe
        
        C:\Windows\system32\emfwpg.exe 452 "C:\Windows\SysWOW64\knojso.exe"
        266⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\ydejmq.exe
        
        C:\Windows\system32\ydejmq.exe 452 "C:\Windows\SysWOW64\emfwpg.exe"
        267⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\ydejmq.exe
        
        C:\Windows\system32\ydejmq.exe 452 "C:\Windows\SysWOW64\emfwpg.exe"
        268⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Windows\SysWOW64\pkerkr.exe
        
        C:\Windows\system32\pkerkr.exe 452 "C:\Windows\SysWOW64\ydejmq.exe"
        269⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\pkerkr.exe
        
        C:\Windows\system32\pkerkr.exe 452 "C:\Windows\SysWOW64\ydejmq.exe"
        270⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\gjfzja.exe
        
        C:\Windows\system32\gjfzja.exe 452 "C:\Windows\SysWOW64\pkerkr.exe"
        271⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Windows\SysWOW64\gjfzja.exe
        
        C:\Windows\system32\gjfzja.exe 452 "C:\Windows\SysWOW64\pkerkr.exe"
        272⤵
        Drops file in System32 directory
        
        PID:2868
        
        C:\Windows\SysWOW64\prnhib.exe
        
        C:\Windows\system32\prnhib.exe 452 "C:\Windows\SysWOW64\gjfzja.exe"
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Windows\SysWOW64\prnhib.exe
        
        C:\Windows\system32\prnhib.exe 452 "C:\Windows\SysWOW64\gjfzja.exe"
        274⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\jheuel.exe
        
        C:\Windows\system32\jheuel.exe 452 "C:\Windows\SysWOW64\prnhib.exe"
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\jheuel.exe
        
        C:\Windows\system32\jheuel.exe 452 "C:\Windows\SysWOW64\prnhib.exe"
        276⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\dgvhbv.exe
        
        C:\Windows\system32\dgvhbv.exe 452 "C:\Windows\SysWOW64\jheuel.exe"
        277⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\dgvhbv.exe
        
        C:\Windows\system32\dgvhbv.exe 452 "C:\Windows\SysWOW64\jheuel.exe"
        278⤵
        Drops file in System32 directory
        
        PID:1264
        
        C:\Windows\SysWOW64\ufwpae.exe
        
        C:\Windows\system32\ufwpae.exe 452 "C:\Windows\SysWOW64\dgvhbv.exe"
        279⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\ufwpae.exe
        
        C:\Windows\system32\ufwpae.exe 452 "C:\Windows\SysWOW64\dgvhbv.exe"
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:2260
        
        C:\Windows\SysWOW64\oevdxo.exe
        
        C:\Windows\system32\oevdxo.exe 452 "C:\Windows\SysWOW64\ufwpae.exe"
        281⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\oevdxo.exe
        
        C:\Windows\system32\oevdxo.exe 452 "C:\Windows\SysWOW64\ufwpae.exe"
        282⤵
        Drops file in System32 directory
        
        PID:2140
        
        C:\Windows\SysWOW64\fakftt.exe
        
        C:\Windows\system32\fakftt.exe 452 "C:\Windows\SysWOW64\oevdxo.exe"
        283⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\fakftt.exe
        
        C:\Windows\system32\fakftt.exe 452 "C:\Windows\SysWOW64\oevdxo.exe"
        284⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\zqjlpd.exe
        
        C:\Windows\system32\zqjlpd.exe 452 "C:\Windows\SysWOW64\fakftt.exe"
        285⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\zqjlpd.exe
        
        C:\Windows\system32\zqjlpd.exe 452 "C:\Windows\SysWOW64\fakftt.exe"
        286⤵
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\tmptjj.exe
        
        C:\Windows\system32\tmptjj.exe 452 "C:\Windows\SysWOW64\zqjlpd.exe"
        287⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\tmptjj.exe
        
        C:\Windows\system32\tmptjj.exe 452 "C:\Windows\SysWOW64\zqjlpd.exe"
        288⤵
        Drops file in System32 directory
        
        PID:2576
        
        C:\Windows\SysWOW64\khmofn.exe
        
        C:\Windows\system32\khmofn.exe 452 "C:\Windows\SysWOW64\tmptjj.exe"
        289⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\khmofn.exe
        
        C:\Windows\system32\khmofn.exe 452 "C:\Windows\SysWOW64\tmptjj.exe"
        290⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\bhnweo.exe
        
        C:\Windows\system32\bhnweo.exe 452 "C:\Windows\SysWOW64\khmofn.exe"
        291⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\bhnweo.exe
        
        C:\Windows\system32\bhnweo.exe 452 "C:\Windows\SysWOW64\khmofn.exe"
        292⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\sryrfc.exe
        
        C:\Windows\system32\sryrfc.exe 452 "C:\Windows\SysWOW64\bhnweo.exe"
        293⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\sryrfc.exe
        
        C:\Windows\system32\sryrfc.exe 452 "C:\Windows\SysWOW64\bhnweo.exe"
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Windows\SysWOW64\mfmrzh.exe
        
        C:\Windows\system32\mfmrzh.exe 452 "C:\Windows\SysWOW64\sryrfc.exe"
        295⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\mfmrzh.exe
        
        C:\Windows\system32\mfmrzh.exe 452 "C:\Windows\SysWOW64\sryrfc.exe"
        296⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\wabude.exe
        
        C:\Windows\system32\wabude.exe 468 "C:\Windows\SysWOW64\mfmrzh.exe"
        297⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\wabude.exe
        
        C:\Windows\system32\wabude.exe 468 "C:\Windows\SysWOW64\mfmrzh.exe"
        298⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\nikccn.exe
        
        C:\Windows\system32\nikccn.exe 452 "C:\Windows\SysWOW64\wabude.exe"
        299⤵
        
        PID:876
        
        C:\Windows\SysWOW64\nikccn.exe
        
        C:\Windows\system32\nikccn.exe 452 "C:\Windows\SysWOW64\wabude.exe"
        300⤵
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\hvqcwt.exe
        
        C:\Windows\system32\hvqcwt.exe 452 "C:\Windows\SysWOW64\nikccn.exe"
        301⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\hvqcwt.exe
        
        C:\Windows\system32\hvqcwt.exe 452 "C:\Windows\SysWOW64\nikccn.exe"
        302⤵
        Drops file in System32 directory
        
        PID:2648
        
        C:\Windows\SysWOW64\ygbxxy.exe
        
        C:\Windows\system32\ygbxxy.exe 452 "C:\Windows\SysWOW64\hvqcwt.exe"
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Windows\SysWOW64\ygbxxy.exe
        
        C:\Windows\system32\ygbxxy.exe 452 "C:\Windows\SysWOW64\hvqcwt.exe"
        304⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\stpxsm.exe
        
        C:\Windows\system32\stpxsm.exe 452 "C:\Windows\SysWOW64\ygbxxy.exe"
        305⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\stpxsm.exe
        
        C:\Windows\system32\stpxsm.exe 452 "C:\Windows\SysWOW64\ygbxxy.exe"
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:636
        
        C:\Windows\SysWOW64\msgkow.exe
        
        C:\Windows\system32\msgkow.exe 452 "C:\Windows\SysWOW64\stpxsm.exe"
        307⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\msgkow.exe
        
        C:\Windows\system32\msgkow.exe 452 "C:\Windows\SysWOW64\stpxsm.exe"
        308⤵
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\drhsnx.exe
        
        C:\Windows\system32\drhsnx.exe 452 "C:\Windows\SysWOW64\msgkow.exe"
        309⤵
        
        PID:532
        
        C:\Windows\SysWOW64\drhsnx.exe
        
        C:\Windows\system32\drhsnx.exe 452 "C:\Windows\SysWOW64\msgkow.exe"
        310⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\xhyfkp.exe
        
        C:\Windows\system32\xhyfkp.exe 452 "C:\Windows\SysWOW64\drhsnx.exe"
        311⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\xhyfkp.exe
        
        C:\Windows\system32\xhyfkp.exe 452 "C:\Windows\SysWOW64\drhsnx.exe"
        312⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Windows\SysWOW64\rdmfev.exe
        
        C:\Windows\system32\rdmfev.exe 452 "C:\Windows\SysWOW64\xhyfkp.exe"
        313⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\rdmfev.exe
        
        C:\Windows\system32\rdmfev.exe 452 "C:\Windows\SysWOW64\xhyfkp.exe"
        314⤵
        Drops file in System32 directory
        
        PID:2356
        
        C:\Windows\SysWOW64\ifxafa.exe
        
        C:\Windows\system32\ifxafa.exe 452 "C:\Windows\SysWOW64\rdmfev.exe"
        315⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\ifxafa.exe
        
        C:\Windows\system32\ifxafa.exe 452 "C:\Windows\SysWOW64\rdmfev.exe"
        316⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\cblbzg.exe
        
        C:\Windows\system32\cblbzg.exe 452 "C:\Windows\SysWOW64\ifxafa.exe"
        317⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\cblbzg.exe
        
        C:\Windows\system32\cblbzg.exe 452 "C:\Windows\SysWOW64\ifxafa.exe"
        318⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\orcowy.exe
        
        C:\Windows\system32\orcowy.exe 452 "C:\Windows\SysWOW64\cblbzg.exe"
        319⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\orcowy.exe
        
        C:\Windows\system32\orcowy.exe 452 "C:\Windows\SysWOW64\cblbzg.exe"
        320⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\fzdwvz.exe
        
        C:\Windows\system32\fzdwvz.exe 452 "C:\Windows\SysWOW64\orcowy.exe"
        321⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\fzdwvz.exe
        
        C:\Windows\system32\fzdwvz.exe 452 "C:\Windows\SysWOW64\orcowy.exe"
        322⤵
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\zpujsj.exe
        
        C:\Windows\system32\zpujsj.exe 452 "C:\Windows\SysWOW64\fzdwvz.exe"
        323⤵
        
        PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bljiez.exe

Filesize
476KB

MD5
f3a6663b8cb810e905ff5c7bed9ef67e

SHA1
8e832fbcd04fad6c103bc8753ad87863454830ac

SHA256
58fa7103a6da18ad8039c901c10af971627efdfb77a27f55a950aa37f4d04dc8

SHA512
986064204320e6b1100e9c83e4691ee1d3aad06cdda575a723e6f49de9ed0ea0c5862b0d87e665167f9e74896dd0cdeaa12de6e1bb6753e68c56387154f98095

Download Submit
memory/552-488-0x0000000001C20000-0x0000000001C99000-memory.dmp

Filesize
484KB

Download
memory/552-492-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/552-474-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/580-95-0x00000000024A0000-0x0000000002519000-memory.dmp

Filesize
484KB

Download
memory/580-96-0x00000000024A0000-0x0000000002519000-memory.dmp

Filesize
484KB

Download
memory/580-88-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/580-100-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/772-625-0x0000000002820000-0x0000000002899000-memory.dmp

Filesize
484KB

Download
memory/984-641-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/988-371-0x0000000002530000-0x00000000025A9000-memory.dmp

Filesize
484KB

Download
memory/988-370-0x0000000002530000-0x00000000025A9000-memory.dmp

Filesize
484KB

Download
memory/1048-718-0x0000000000220000-0x0000000000299000-memory.dmp

Filesize
484KB

Download
memory/1048-716-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1048-700-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1148-673-0x0000000002400000-0x0000000002479000-memory.dmp

Filesize
484KB

Download
memory/1200-496-0x00000000027E0000-0x0000000002859000-memory.dmp

Filesize
484KB

Download
memory/1464-249-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1464-232-0x00000000004F0000-0x0000000000569000-memory.dmp

Filesize
484KB

Download
memory/1472-199-0x0000000000310000-0x0000000000389000-memory.dmp

Filesize
484KB

Download
memory/1472-216-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1472-213-0x0000000000310000-0x0000000000389000-memory.dmp

Filesize
484KB

Download
memory/1472-742-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1560-646-0x0000000002860000-0x00000000028D9000-memory.dmp

Filesize
484KB

Download
memory/1608-390-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1608-389-0x0000000000250000-0x00000000002C9000-memory.dmp

Filesize
484KB

Download
memory/1608-374-0x0000000000250000-0x00000000002C9000-memory.dmp

Filesize
484KB

Download
memory/1632-568-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1640-254-0x0000000002610000-0x0000000002689000-memory.dmp

Filesize
484KB

Download
memory/1640-259-0x0000000002610000-0x0000000002689000-memory.dmp

Filesize
484KB

Download
memory/1652-552-0x00000000025C0000-0x0000000002639000-memory.dmp

Filesize
484KB

Download
memory/1652-551-0x00000000025C0000-0x0000000002639000-memory.dmp

Filesize
484KB

Download
memory/1696-699-0x0000000002470000-0x00000000024E9000-memory.dmp

Filesize
484KB

Download
memory/1744-440-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1748-129-0x00000000027B0000-0x0000000002829000-memory.dmp

Filesize
484KB

Download
memory/1748-128-0x00000000027B0000-0x0000000002829000-memory.dmp

Filesize
484KB

Download
memory/1748-131-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1756-161-0x0000000002500000-0x0000000002579000-memory.dmp

Filesize
484KB

Download
memory/2004-401-0x0000000000330000-0x00000000003A9000-memory.dmp

Filesize
484KB

Download
memory/2004-416-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2040-423-0x00000000027A0000-0x0000000002819000-memory.dmp

Filesize
484KB

Download
memory/2060-313-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2072-692-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2072-691-0x00000000002C0000-0x0000000000339000-memory.dmp

Filesize
484KB

Download
memory/2072-674-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2092-226-0x0000000002790000-0x0000000002809000-memory.dmp

Filesize
484KB

Download
memory/2164-118-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2168-543-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2168-526-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2168-537-0x0000000000240000-0x00000000002B9000-memory.dmp

Filesize
484KB

Download
memory/2212-397-0x0000000002810000-0x0000000002889000-memory.dmp

Filesize
484KB

Download
memory/2212-398-0x0000000002810000-0x0000000002889000-memory.dmp

Filesize
484KB

Download
memory/2276-473-0x0000000002770000-0x00000000027E9000-memory.dmp

Filesize
484KB

Download
memory/2276-469-0x0000000002770000-0x00000000027E9000-memory.dmp

Filesize
484KB

Download
memory/2292-291-0x0000000000360000-0x00000000003D9000-memory.dmp

Filesize
484KB

Download
memory/2292-292-0x0000000000360000-0x00000000003D9000-memory.dmp

Filesize
484KB

Download
memory/2324-192-0x00000000027C0000-0x0000000002839000-memory.dmp

Filesize
484KB

Download
memory/2324-193-0x00000000027C0000-0x0000000002839000-memory.dmp

Filesize
484KB

Download
memory/2400-13-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2408-464-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2408-456-0x0000000000220000-0x0000000000299000-memory.dmp

Filesize
484KB

Download
memory/2456-447-0x00000000026C0000-0x0000000002739000-memory.dmp

Filesize
484KB

Download
memory/2500-515-0x00000000002E0000-0x0000000000359000-memory.dmp

Filesize
484KB

Download
memory/2500-516-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2516-282-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2516-265-0x0000000000220000-0x0000000000299000-memory.dmp

Filesize
484KB

Download
memory/2616-70-0x0000000001C70000-0x0000000001CE9000-memory.dmp

Filesize
484KB

Download
memory/2616-80-0x0000000001C70000-0x0000000001CE9000-memory.dmp

Filesize
484KB

Download
memory/2616-84-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2640-617-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2676-726-0x00000000024E0000-0x0000000002559000-memory.dmp

Filesize
484KB

Download
memory/2676-183-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2676-725-0x00000000024E0000-0x0000000002559000-memory.dmp

Filesize
484KB

Download
memory/2688-61-0x0000000002920000-0x0000000002999000-memory.dmp

Filesize
484KB

Download
memory/2688-65-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2688-60-0x0000000002920000-0x0000000002999000-memory.dmp

Filesize
484KB

Download
memory/2688-51-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2692-594-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2692-577-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2700-601-0x00000000024B0000-0x0000000002529000-memory.dmp

Filesize
484KB

Download
memory/2720-5-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-10-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-11-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-9-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-7-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-1-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-14-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-3-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-15-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-25-0x0000000002640000-0x00000000026B9000-memory.dmp

Filesize
484KB

Download
memory/2720-30-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-26-0x0000000002640000-0x00000000026B9000-memory.dmp

Filesize
484KB

Download
memory/2736-45-0x0000000001C80000-0x0000000001CF9000-memory.dmp

Filesize
484KB

Download
memory/2736-39-0x0000000001C80000-0x0000000001CF9000-memory.dmp

Filesize
484KB

Download
memory/2736-48-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2740-339-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2804-576-0x00000000024F0000-0x0000000002569000-memory.dmp

Filesize
484KB

Download
memory/2844-322-0x0000000000620000-0x0000000000699000-memory.dmp

Filesize
484KB

Download
memory/2872-152-0x0000000001BB0000-0x0000000001C29000-memory.dmp

Filesize
484KB

Download
memory/2872-151-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2888-666-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2972-524-0x00000000025C0000-0x0000000002639000-memory.dmp

Filesize
484KB

Download
memory/2972-525-0x00000000025C0000-0x0000000002639000-memory.dmp

Filesize
484KB

Download
memory/3004-363-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3004-348-0x0000000000480000-0x00000000004F9000-memory.dmp

Filesize
484KB

Download