metasploit | cb7c957512e28316854bf79037d88cdd7e349f43340d80ba53668e7974a4cb82

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/01/2025, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
Size

526KB
MD5

007f1600b0a0777c591f415db8ec29a3
SHA1

76bc884c55c46fa51b804dfc5f6d5a0a2135b9a2
SHA256

cb7c957512e28316854bf79037d88cdd7e349f43340d80ba53668e7974a4cb82
SHA512

b2656f206e161888fe3f798bf757ab6cd95b49424da6219d70ae866e1db52f3f826bb5c647a510b4c9e78d1bc2db05e67b40763b04ffdf3a8818fed1e04bddc4
SSDEEP

12288:SHN3d5HDR40EFZjLDLuluC89Ew5nph2rxxnew80aEL1c0nb4auvhGzY:SHv5jRfEnXiuB9cDeCaERh4a98

Score

10^/10

metasploit backdoor defense_evasion discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 64 IoCs

pid	Process
2736	dbel.exe
276	uidi.exe
2088	krqa.exe
2136	zcvg.exe
2980	fgvd.exe
376	fshw.exe
2384	fkqo.exe
2728	hbww.exe
2700	wzdw.exe
632	blxe.exe
440	dzzg.exe
2584	doxm.exe
1408	shug.exe
2240	zphz.exe
708	hqgz.exe
1692	mjwz.exe
2892	myme.exe
2588	dnkj.exe
300	omph.exe
2380	bzge.exe
2364	ljvh.exe
2868	viim.exe
988	izcp.exe
2512	phqh.exe
2268	cftk.exe
1516	jqrp.exe
2688	wpmr.exe
2848	goyp.exe
2896	tets.exe
1176	dlfp.exe
2836	novz.exe
2204	ykns.exe
1800	kaqn.exe
3048	stpa.exe
2824	fkkc.exe
1240	pjwa.exe
2764	chrc.exe
2068	mdsn.exe
2084	wrsk.exe
2340	gqwi.exe
1924	thrk.exe
2392	dgdi.exe
1616	qeyk.exe
2100	ncfl.exe
2708	xeuv.exe
2036	jgal.exe
2360	wxvf.exe
568	jnyi.exe
372	ujza.exe
1544	vxsq.exe
2876	ikjn.exe
2656	vmpv.exe
2660	fltt.exe
1300	snhi.exe
2128	cjab.exe
2636	mlqd.exe
2196	wsci.exe
1576	jmiq.exe
1760	tumo.exe
2044	ghdl.exe
1436	qgij.exe
2444	dioq.exe
1828	nklb.exe
2884	axvy.exe

Identifies Wine through registry keys 2 TTPs 64 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	dumd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	wwod.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	bjmp.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	ncfl.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	jnyi.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	dioq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	axvy.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	fxwm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	winb.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	stpa.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	vnjm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	ojvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	krqa.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	wzdw.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	pjwa.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	swro.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	vpon.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	jgal.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	mzio.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	yjca.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	jogj.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	klis.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	bayf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	htql.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	duiq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	gvic.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	uqgm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	lrlv.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	efpy.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	lhjl.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	cuok.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	nksj.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	efxi.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	viim.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	xdlm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	lgaa.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	hlcp.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	favn.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	hgjp.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	yimm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	udvi.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	ozhs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	qmea.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	doxm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	wxvf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	ikjn.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	ntyj.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	dgms.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	iztk.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	vxsq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	ilml.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	fkqo.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	mvnl.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	hxvq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	txnz.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	uzoa.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	sphj.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	pvth.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	fgvd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	fshw.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	fltt.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	iedo.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	vjww.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	aesj.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
1728	JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
2736	dbel.exe
2736	dbel.exe
276	uidi.exe
276	uidi.exe
2088	krqa.exe
2088	krqa.exe
2136	zcvg.exe
2136	zcvg.exe
2980	fgvd.exe
2980	fgvd.exe
376	fshw.exe
376	fshw.exe
2384	fkqo.exe
2384	fkqo.exe
2728	hbww.exe
2728	hbww.exe
2700	wzdw.exe
2700	wzdw.exe
632	blxe.exe
632	blxe.exe
440	dzzg.exe
440	dzzg.exe
2584	doxm.exe
2584	doxm.exe
1408	shug.exe
1408	shug.exe
2240	zphz.exe
2240	zphz.exe
708	hqgz.exe
708	hqgz.exe
1692	mjwz.exe
1692	mjwz.exe
2892	myme.exe
2892	myme.exe
2588	dnkj.exe
2588	dnkj.exe
300	omph.exe
300	omph.exe
2380	bzge.exe
2380	bzge.exe
2364	ljvh.exe
2364	ljvh.exe
2868	viim.exe
2868	viim.exe
988	izcp.exe
988	izcp.exe
2512	phqh.exe
2512	phqh.exe
2268	cftk.exe
2268	cftk.exe
1516	jqrp.exe
1516	jqrp.exe
2688	wpmr.exe
2688	wpmr.exe
2848	goyp.exe
2848	goyp.exe
2896	tets.exe
2896	tets.exe
1176	dlfp.exe
1176	dlfp.exe
2836	novz.exe
2836	novz.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\yqfy.exe	lrlv.exe
File created	C:\Windows\SysWOW64\ynhp.exe	ozhs.exe
File created	C:\Windows\SysWOW64\ilml.exe	vnji.exe
File created	C:\Windows\SysWOW64\txnz.exe	ggsw.exe
File opened for modification	C:\Windows\SysWOW64\mkkj.exe	zuqo.exe
File opened for modification	C:\Windows\SysWOW64\snhi.exe	fltt.exe
File opened for modification	C:\Windows\SysWOW64\uidi.exe	dbel.exe
File created	C:\Windows\SysWOW64\jkty.exe	aesj.exe
File opened for modification	C:\Windows\SysWOW64\ajnm.exe	nksj.exe
File opened for modification	C:\Windows\SysWOW64\ywnh.exe	lyse.exe
File created	C:\Windows\SysWOW64\knqk.exe	ywnh.exe
File created	C:\Windows\SysWOW64\hgjp.exe	uqgm.exe
File created	C:\Windows\SysWOW64\favn.exe	scak.exe
File created	C:\Windows\SysWOW64\okrn.exe	cuok.exe
File opened for modification	C:\Windows\SysWOW64\nhns.exe	bisq.exe
File created	C:\Windows\SysWOW64\fkqo.exe	fshw.exe
File created	C:\Windows\SysWOW64\snle.exe	jknu.exe
File opened for modification	C:\Windows\SysWOW64\iacq.exe	vcho.exe
File created	C:\Windows\SysWOW64\ykns.exe	novz.exe
File created	C:\Windows\SysWOW64\jelp.exe	wnim.exe
File opened for modification	C:\Windows\SysWOW64\plfx.exe	cvku.exe
File opened for modification	C:\Windows\SysWOW64\vels.exe	igip.exe
File created	C:\Windows\SysWOW64\xeuv.exe	ncfl.exe
File created	C:\Windows\SysWOW64\ebkw.exe	rdpu.exe
File opened for modification	C:\Windows\SysWOW64\djkj.exe	qshg.exe
File created	C:\Windows\SysWOW64\jftb.exe	whyg.exe
File opened for modification	C:\Windows\SysWOW64\pjag.exe	fvzr.exe
File opened for modification	C:\Windows\SysWOW64\bisq.exe	ospn.exe
File opened for modification	C:\Windows\SysWOW64\duiq.exe	ustg.exe
File opened for modification	C:\Windows\SysWOW64\hbww.exe	fkqo.exe
File opened for modification	C:\Windows\SysWOW64\bgfx.exe	ohku.exe
File opened for modification	C:\Windows\SysWOW64\jknu.exe	wusr.exe
File opened for modification	C:\Windows\SysWOW64\udoy.exe	hmtv.exe
File opened for modification	C:\Windows\SysWOW64\dgdi.exe	thrk.exe
File opened for modification	C:\Windows\SysWOW64\jqrp.exe	cftk.exe
File created	C:\Windows\SysWOW64\qeyk.exe	dgdi.exe
File opened for modification	C:\Windows\SysWOW64\hrlk.exe	xdlm.exe
File opened for modification	C:\Windows\SysWOW64\uzoa.exe	haty.exe
File opened for modification	C:\Windows\SysWOW64\acdg.exe	nmad.exe
File opened for modification	C:\Windows\SysWOW64\coto.exe	pyym.exe
File created	C:\Windows\SysWOW64\qxhv.exe	dgms.exe
File created	C:\Windows\SysWOW64\omph.exe	dnkj.exe
File created	C:\Windows\SysWOW64\jzqd.exe	winb.exe
File created	C:\Windows\SysWOW64\winb.exe	jkty.exe
File created	C:\Windows\SysWOW64\yzgu.exe	plfx.exe
File opened for modification	C:\Windows\SysWOW64\ucfr.exe	hlcp.exe
File created	C:\Windows\SysWOW64\acdg.exe	nmad.exe
File opened for modification	C:\Windows\SysWOW64\hqgz.exe	zphz.exe
File created	C:\Windows\SysWOW64\gqwi.exe	wrsk.exe
File created	C:\Windows\SysWOW64\anfb.exe	nxly.exe
File created	C:\Windows\SysWOW64\wlmj.exe	jmrg.exe
File opened for modification	C:\Windows\SysWOW64\igip.exe	vpon.exe
File created	C:\Windows\SysWOW64\zcvg.exe	krqa.exe
File opened for modification	C:\Windows\SysWOW64\wrsk.exe	mdsn.exe
File created	C:\Windows\SysWOW64\kikb.exe	axvy.exe
File created	C:\Windows\SysWOW64\cftk.exe	phqh.exe
File opened for modification	C:\Windows\SysWOW64\wlmj.exe	jmrg.exe
File opened for modification	C:\Windows\SysWOW64\uxhz.exe	pcxj.exe
File created	C:\Windows\SysWOW64\axiv.exe	nhns.exe
File created	C:\Windows\SysWOW64\fgei.exe	sqkf.exe
File created	C:\Windows\SysWOW64\czvj.exe	pjag.exe
File opened for modification	C:\Windows\SysWOW64\okrn.exe	cuok.exe
File opened for modification	C:\Windows\SysWOW64\ycfv.exe	leks.exe
File created	C:\Windows\SysWOW64\hmtv.exe	uoys.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tets.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvku.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ylsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbjz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ltax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	optr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyct.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fgkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	haty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uzoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vmpv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uqgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aulr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xclv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qjzk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dvjy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twzp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	izcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gmur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dgdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mzio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efpy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jmrg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kpvl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lhjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cpmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lrlv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zazu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knzz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qxhv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fxwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uxes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bayf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	viim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjwa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhzg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qeyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nxly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gzmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ivgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gqwi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2736	1728	JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe	30
PID 1728 wrote to memory of 2736	1728	JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe	30
PID 1728 wrote to memory of 2736	1728	JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe	30
PID 1728 wrote to memory of 2736	1728	JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe	30
PID 2736 wrote to memory of 276	2736	dbel.exe	31
PID 2736 wrote to memory of 276	2736	dbel.exe	31
PID 2736 wrote to memory of 276	2736	dbel.exe	31
PID 2736 wrote to memory of 276	2736	dbel.exe	31
PID 276 wrote to memory of 2088	276	uidi.exe	32
PID 276 wrote to memory of 2088	276	uidi.exe	32
PID 276 wrote to memory of 2088	276	uidi.exe	32
PID 276 wrote to memory of 2088	276	uidi.exe	32
PID 2088 wrote to memory of 2136	2088	krqa.exe	33
PID 2088 wrote to memory of 2136	2088	krqa.exe	33
PID 2088 wrote to memory of 2136	2088	krqa.exe	33
PID 2088 wrote to memory of 2136	2088	krqa.exe	33
PID 2136 wrote to memory of 2980	2136	zcvg.exe	34
PID 2136 wrote to memory of 2980	2136	zcvg.exe	34
PID 2136 wrote to memory of 2980	2136	zcvg.exe	34
PID 2136 wrote to memory of 2980	2136	zcvg.exe	34
PID 2980 wrote to memory of 376	2980	fgvd.exe	35
PID 2980 wrote to memory of 376	2980	fgvd.exe	35
PID 2980 wrote to memory of 376	2980	fgvd.exe	35
PID 2980 wrote to memory of 376	2980	fgvd.exe	35
PID 376 wrote to memory of 2384	376	fshw.exe	36
PID 376 wrote to memory of 2384	376	fshw.exe	36
PID 376 wrote to memory of 2384	376	fshw.exe	36
PID 376 wrote to memory of 2384	376	fshw.exe	36
PID 2384 wrote to memory of 2728	2384	fkqo.exe	37
PID 2384 wrote to memory of 2728	2384	fkqo.exe	37
PID 2384 wrote to memory of 2728	2384	fkqo.exe	37
PID 2384 wrote to memory of 2728	2384	fkqo.exe	37
PID 2728 wrote to memory of 2700	2728	hbww.exe	38
PID 2728 wrote to memory of 2700	2728	hbww.exe	38
PID 2728 wrote to memory of 2700	2728	hbww.exe	38
PID 2728 wrote to memory of 2700	2728	hbww.exe	38
PID 2700 wrote to memory of 632	2700	wzdw.exe	39
PID 2700 wrote to memory of 632	2700	wzdw.exe	39
PID 2700 wrote to memory of 632	2700	wzdw.exe	39
PID 2700 wrote to memory of 632	2700	wzdw.exe	39
PID 632 wrote to memory of 440	632	blxe.exe	40
PID 632 wrote to memory of 440	632	blxe.exe	40
PID 632 wrote to memory of 440	632	blxe.exe	40
PID 632 wrote to memory of 440	632	blxe.exe	40
PID 440 wrote to memory of 2584	440	dzzg.exe	41
PID 440 wrote to memory of 2584	440	dzzg.exe	41
PID 440 wrote to memory of 2584	440	dzzg.exe	41
PID 440 wrote to memory of 2584	440	dzzg.exe	41
PID 2584 wrote to memory of 1408	2584	doxm.exe	42
PID 2584 wrote to memory of 1408	2584	doxm.exe	42
PID 2584 wrote to memory of 1408	2584	doxm.exe	42
PID 2584 wrote to memory of 1408	2584	doxm.exe	42
PID 1408 wrote to memory of 2240	1408	shug.exe	43
PID 1408 wrote to memory of 2240	1408	shug.exe	43
PID 1408 wrote to memory of 2240	1408	shug.exe	43
PID 1408 wrote to memory of 2240	1408	shug.exe	43
PID 2240 wrote to memory of 708	2240	zphz.exe	44
PID 2240 wrote to memory of 708	2240	zphz.exe	44
PID 2240 wrote to memory of 708	2240	zphz.exe	44
PID 2240 wrote to memory of 708	2240	zphz.exe	44
PID 708 wrote to memory of 1692	708	hqgz.exe	45
PID 708 wrote to memory of 1692	708	hqgz.exe	45
PID 708 wrote to memory of 1692	708	hqgz.exe	45
PID 708 wrote to memory of 1692	708	hqgz.exe	45

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\dbel.exe
  C:\Windows\system32\dbel.exe 636 "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\uidi.exe
    C:\Windows\system32\uidi.exe 612 "C:\Windows\SysWOW64\dbel.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Windows\SysWOW64\krqa.exe
      C:\Windows\system32\krqa.exe 616 "C:\Windows\SysWOW64\uidi.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2088
    - - C:\Windows\SysWOW64\zcvg.exe
        
        C:\Windows\system32\zcvg.exe 620 "C:\Windows\SysWOW64\krqa.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2136
      - C:\Windows\SysWOW64\fgvd.exe
        
        C:\Windows\system32\fgvd.exe 640 "C:\Windows\SysWOW64\zcvg.exe"
        6⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\fshw.exe
        
        C:\Windows\system32\fshw.exe 660 "C:\Windows\SysWOW64\fgvd.exe"
        7⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\fkqo.exe
        
        C:\Windows\system32\fkqo.exe 628 "C:\Windows\SysWOW64\fshw.exe"
        8⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\hbww.exe
        
        C:\Windows\system32\hbww.exe 632 "C:\Windows\SysWOW64\fkqo.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\wzdw.exe
        
        C:\Windows\system32\wzdw.exe 624 "C:\Windows\SysWOW64\hbww.exe"
        10⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\blxe.exe
        
        C:\Windows\system32\blxe.exe 644 "C:\Windows\SysWOW64\wzdw.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\SysWOW64\dzzg.exe
        
        C:\Windows\system32\dzzg.exe 652 "C:\Windows\SysWOW64\blxe.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\doxm.exe
        
        C:\Windows\system32\doxm.exe 668 "C:\Windows\SysWOW64\dzzg.exe"
        13⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\shug.exe
        
        C:\Windows\system32\shug.exe 736 "C:\Windows\SysWOW64\doxm.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\zphz.exe
        
        C:\Windows\system32\zphz.exe 740 "C:\Windows\SysWOW64\shug.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\hqgz.exe
        
        C:\Windows\system32\hqgz.exe 656 "C:\Windows\SysWOW64\zphz.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Windows\SysWOW64\mjwz.exe
        
        C:\Windows\system32\mjwz.exe 708 "C:\Windows\SysWOW64\hqgz.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1692
        
        C:\Windows\SysWOW64\myme.exe
        
        C:\Windows\system32\myme.exe 664 "C:\Windows\SysWOW64\mjwz.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2892
        
        C:\Windows\SysWOW64\dnkj.exe
        
        C:\Windows\system32\dnkj.exe 756 "C:\Windows\SysWOW64\myme.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Windows\SysWOW64\omph.exe
        
        C:\Windows\system32\omph.exe 764 "C:\Windows\SysWOW64\dnkj.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:300
        
        C:\Windows\SysWOW64\bzge.exe
        
        C:\Windows\system32\bzge.exe 768 "C:\Windows\SysWOW64\omph.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\ljvh.exe
        
        C:\Windows\system32\ljvh.exe 772 "C:\Windows\SysWOW64\bzge.exe"
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2364
        
        C:\Windows\SysWOW64\viim.exe
        
        C:\Windows\system32\viim.exe 792 "C:\Windows\SysWOW64\ljvh.exe"
        23⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Windows\SysWOW64\izcp.exe
        
        C:\Windows\system32\izcp.exe 776 "C:\Windows\SysWOW64\viim.exe"
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:988
        
        C:\Windows\SysWOW64\phqh.exe
        
        C:\Windows\system32\phqh.exe 780 "C:\Windows\SysWOW64\izcp.exe"
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Windows\SysWOW64\cftk.exe
        
        C:\Windows\system32\cftk.exe 760 "C:\Windows\SysWOW64\phqh.exe"
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2268
        
        C:\Windows\SysWOW64\jqrp.exe
        
        C:\Windows\system32\jqrp.exe 788 "C:\Windows\SysWOW64\cftk.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1516
        
        C:\Windows\SysWOW64\wpmr.exe
        
        C:\Windows\system32\wpmr.exe 796 "C:\Windows\SysWOW64\jqrp.exe"
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2688
        
        C:\Windows\SysWOW64\goyp.exe
        
        C:\Windows\system32\goyp.exe 800 "C:\Windows\SysWOW64\wpmr.exe"
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2848
        
        C:\Windows\SysWOW64\tets.exe
        
        C:\Windows\system32\tets.exe 784 "C:\Windows\SysWOW64\goyp.exe"
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Windows\SysWOW64\dlfp.exe
        
        C:\Windows\system32\dlfp.exe 812 "C:\Windows\SysWOW64\tets.exe"
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1176
        
        C:\Windows\SysWOW64\novz.exe
        
        C:\Windows\system32\novz.exe 808 "C:\Windows\SysWOW64\dlfp.exe"
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2836
        
        C:\Windows\SysWOW64\ykns.exe
        
        C:\Windows\system32\ykns.exe 820 "C:\Windows\SysWOW64\novz.exe"
        33⤵
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\kaqn.exe
        
        C:\Windows\system32\kaqn.exe 816 "C:\Windows\SysWOW64\ykns.exe"
        34⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\stpa.exe
        
        C:\Windows\system32\stpa.exe 832 "C:\Windows\SysWOW64\kaqn.exe"
        35⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:3048
        
        C:\Windows\SysWOW64\fkkc.exe
        
        C:\Windows\system32\fkkc.exe 824 "C:\Windows\SysWOW64\stpa.exe"
        36⤵
        Executes dropped EXE
        
        PID:2824
        
        C:\Windows\SysWOW64\pjwa.exe
        
        C:\Windows\system32\pjwa.exe 828 "C:\Windows\SysWOW64\fkkc.exe"
        37⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:1240
        
        C:\Windows\SysWOW64\chrc.exe
        
        C:\Windows\system32\chrc.exe 836 "C:\Windows\SysWOW64\pjwa.exe"
        38⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Windows\SysWOW64\mdsn.exe
        
        C:\Windows\system32\mdsn.exe 840 "C:\Windows\SysWOW64\chrc.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2068
        
        C:\Windows\SysWOW64\wrsk.exe
        
        C:\Windows\system32\wrsk.exe 804 "C:\Windows\SysWOW64\mdsn.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\gqwi.exe
        
        C:\Windows\system32\gqwi.exe 848 "C:\Windows\SysWOW64\wrsk.exe"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\thrk.exe
        
        C:\Windows\system32\thrk.exe 844 "C:\Windows\SysWOW64\gqwi.exe"
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1924
        
        C:\Windows\SysWOW64\dgdi.exe
        
        C:\Windows\system32\dgdi.exe 856 "C:\Windows\SysWOW64\thrk.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Windows\SysWOW64\qeyk.exe
        
        C:\Windows\system32\qeyk.exe 860 "C:\Windows\SysWOW64\dgdi.exe"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Windows\SysWOW64\aazv.exe
        
        C:\Windows\system32\aazv.exe 852 "C:\Windows\SysWOW64\qeyk.exe"
        45⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\ncfl.exe
        
        C:\Windows\system32\ncfl.exe 864 "C:\Windows\SysWOW64\aazv.exe"
        46⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:2100
        
        C:\Windows\SysWOW64\xeuv.exe
        
        C:\Windows\system32\xeuv.exe 872 "C:\Windows\SysWOW64\ncfl.exe"
        47⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\jgal.exe
        
        C:\Windows\system32\jgal.exe 876 "C:\Windows\SysWOW64\xeuv.exe"
        48⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:2036
        
        C:\Windows\SysWOW64\wxvf.exe
        
        C:\Windows\system32\wxvf.exe 884 "C:\Windows\SysWOW64\jgal.exe"
        49⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:2360
        
        C:\Windows\SysWOW64\jnyi.exe
        
        C:\Windows\system32\jnyi.exe 880 "C:\Windows\SysWOW64\wxvf.exe"
        50⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:568
        
        C:\Windows\SysWOW64\ujza.exe
        
        C:\Windows\system32\ujza.exe 900 "C:\Windows\SysWOW64\jnyi.exe"
        51⤵
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\vxsq.exe
        
        C:\Windows\system32\vxsq.exe 868 "C:\Windows\SysWOW64\ujza.exe"
        52⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:1544
        
        C:\Windows\SysWOW64\ikjn.exe
        
        C:\Windows\system32\ikjn.exe 896 "C:\Windows\SysWOW64\vxsq.exe"
        53⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:2876
        
        C:\Windows\SysWOW64\vmpv.exe
        
        C:\Windows\system32\vmpv.exe 888 "C:\Windows\SysWOW64\ikjn.exe"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Windows\SysWOW64\fltt.exe
        
        C:\Windows\system32\fltt.exe 908 "C:\Windows\SysWOW64\vmpv.exe"
        55⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:2660
        
        C:\Windows\SysWOW64\snhi.exe
        
        C:\Windows\system32\snhi.exe 904 "C:\Windows\SysWOW64\fltt.exe"
        56⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Windows\SysWOW64\cjab.exe
        
        C:\Windows\system32\cjab.exe 892 "C:\Windows\SysWOW64\snhi.exe"
        57⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\mlqd.exe
        
        C:\Windows\system32\mlqd.exe 928 "C:\Windows\SysWOW64\cjab.exe"
        58⤵
        Executes dropped EXE
        
        PID:2636
        
        C:\Windows\SysWOW64\wsci.exe
        
        C:\Windows\system32\wsci.exe 920 "C:\Windows\SysWOW64\mlqd.exe"
        59⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\jmiq.exe
        
        C:\Windows\system32\jmiq.exe 916 "C:\Windows\SysWOW64\wsci.exe"
        60⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\tumo.exe
        
        C:\Windows\system32\tumo.exe 932 "C:\Windows\SysWOW64\jmiq.exe"
        61⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\SysWOW64\ghdl.exe
        
        C:\Windows\system32\ghdl.exe 912 "C:\Windows\SysWOW64\tumo.exe"
        62⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\qgij.exe
        
        C:\Windows\system32\qgij.exe 940 "C:\Windows\SysWOW64\ghdl.exe"
        63⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\dioq.exe
        
        C:\Windows\system32\dioq.exe 924 "C:\Windows\SysWOW64\qgij.exe"
        64⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:2444
        
        C:\Windows\SysWOW64\nklb.exe
        
        C:\Windows\system32\nklb.exe 948 "C:\Windows\SysWOW64\dioq.exe"
        65⤵
        Executes dropped EXE
        
        PID:1828
        
        C:\Windows\SysWOW64\axvy.exe
        
        C:\Windows\system32\axvy.exe 936 "C:\Windows\SysWOW64\nklb.exe"
        66⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:2884
        
        C:\Windows\SysWOW64\kikb.exe
        
        C:\Windows\system32\kikb.exe 964 "C:\Windows\SysWOW64\axvy.exe"
        67⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cpmo.exe
        
        C:\Windows\system32\cpmo.exe 944 "C:\Windows\SysWOW64\kikb.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Windows\SysWOW64\mvnl.exe
        
        C:\Windows\system32\mvnl.exe 960 "C:\Windows\SysWOW64\cpmo.exe"
        69⤵
        Identifies Wine through registry keys
        
        PID:2696
        
        C:\Windows\SysWOW64\zuqo.exe
        
        C:\Windows\system32\zuqo.exe 956 "C:\Windows\SysWOW64\mvnl.exe"
        70⤵
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\mkkj.exe
        
        C:\Windows\system32\mkkj.exe 968 "C:\Windows\SysWOW64\zuqo.exe"
        71⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\zjfm.exe
        
        C:\Windows\system32\zjfm.exe 972 "C:\Windows\SysWOW64\mkkj.exe"
        72⤵
        
        PID:912
        
        C:\Windows\SysWOW64\mzio.exe
        
        C:\Windows\system32\mzio.exe 976 "C:\Windows\SysWOW64\zjfm.exe"
        73⤵
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\vnjm.exe
        
        C:\Windows\system32\vnjm.exe 952 "C:\Windows\SysWOW64\mzio.exe"
        74⤵
        Identifies Wine through registry keys
        
        PID:2608
        
        C:\Windows\SysWOW64\iedo.exe
        
        C:\Windows\system32\iedo.exe 988 "C:\Windows\SysWOW64\vnjm.exe"
        75⤵
        Identifies Wine through registry keys
        
        PID:2112
        
        C:\Windows\SysWOW64\vcyr.exe
        
        C:\Windows\system32\vcyr.exe 984 "C:\Windows\SysWOW64\iedo.exe"
        76⤵
        
        PID:676
        
        C:\Windows\SysWOW64\ittu.exe
        
        C:\Windows\system32\ittu.exe 996 "C:\Windows\SysWOW64\vcyr.exe"
        77⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\vjww.exe
        
        C:\Windows\system32\vjww.exe 992 "C:\Windows\SysWOW64\ittu.exe"
        78⤵
        Identifies Wine through registry keys
        
        PID:1956
        
        C:\Windows\SysWOW64\fxwm.exe
        
        C:\Windows\system32\fxwm.exe 752 "C:\Windows\SysWOW64\vjww.exe"
        79⤵
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\SysWOW64\swro.exe
        
        C:\Windows\system32\swro.exe 1004 "C:\Windows\SysWOW64\fxwm.exe"
        80⤵
        Identifies Wine through registry keys
        
        PID:1424
        
        C:\Windows\SysWOW64\fmmr.exe
        
        C:\Windows\system32\fmmr.exe 1016 "C:\Windows\SysWOW64\swro.exe"
        81⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\rdpu.exe
        
        C:\Windows\system32\rdpu.exe 1000 "C:\Windows\SysWOW64\fmmr.exe"
        82⤵
        Drops file in System32 directory
        
        PID:576
        
        C:\Windows\SysWOW64\ebkw.exe
        
        C:\Windows\system32\ebkw.exe 1032 "C:\Windows\SysWOW64\rdpu.exe"
        83⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\ohku.exe
        
        C:\Windows\system32\ohku.exe 1012 "C:\Windows\SysWOW64\ebkw.exe"
        84⤵
        Drops file in System32 directory
        
        PID:1032
        
        C:\Windows\SysWOW64\bgfx.exe
        
        C:\Windows\system32\bgfx.exe 1020 "C:\Windows\SysWOW64\ohku.exe"
        85⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\owiz.exe
        
        C:\Windows\system32\owiz.exe 1028 "C:\Windows\SysWOW64\bgfx.exe"
        86⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\yhxc.exe
        
        C:\Windows\system32\yhxc.exe 1036 "C:\Windows\SysWOW64\owiz.exe"
        87⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\lyse.exe
        
        C:\Windows\system32\lyse.exe 1040 "C:\Windows\SysWOW64\yhxc.exe"
        88⤵
        Drops file in System32 directory
        
        PID:2616
        
        C:\Windows\SysWOW64\ywnh.exe
        
        C:\Windows\system32\ywnh.exe 1056 "C:\Windows\SysWOW64\lyse.exe"
        89⤵
        Drops file in System32 directory
        
        PID:2180
        
        C:\Windows\SysWOW64\knqk.exe
        
        C:\Windows\system32\knqk.exe 1044 "C:\Windows\SysWOW64\ywnh.exe"
        90⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\xdlm.exe
        
        C:\Windows\system32\xdlm.exe 1048 "C:\Windows\SysWOW64\knqk.exe"
        91⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:2672
        
        C:\Windows\SysWOW64\hrlk.exe
        
        C:\Windows\system32\hrlk.exe 1052 "C:\Windows\SysWOW64\xdlm.exe"
        92⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\uqgm.exe
        
        C:\Windows\system32\uqgm.exe 1060 "C:\Windows\SysWOW64\hrlk.exe"
        93⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Windows\SysWOW64\hgjp.exe
        
        C:\Windows\system32\hgjp.exe 1064 "C:\Windows\SysWOW64\uqgm.exe"
        94⤵
        Identifies Wine through registry keys
        
        PID:2816
        
        C:\Windows\SysWOW64\uxes.exe
        
        C:\Windows\system32\uxes.exe 1072 "C:\Windows\SysWOW64\hgjp.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\hvyv.exe
        
        C:\Windows\system32\hvyv.exe 1076 "C:\Windows\SysWOW64\uxes.exe"
        96⤵
        
        PID:672
        
        C:\Windows\SysWOW64\qjzk.exe
        
        C:\Windows\system32\qjzk.exe 1092 "C:\Windows\SysWOW64\hvyv.exe"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:1748
        
        C:\Windows\SysWOW64\daun.exe
        
        C:\Windows\system32\daun.exe 1068 "C:\Windows\SysWOW64\qjzk.exe"
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Windows\SysWOW64\qqxp.exe
        
        C:\Windows\system32\qqxp.exe 1080 "C:\Windows\SysWOW64\daun.exe"
        99⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\vprs.exe
        
        C:\Windows\system32\vprs.exe 1084 "C:\Windows\SysWOW64\qqxp.exe"
        100⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\frhc.exe
        
        C:\Windows\system32\frhc.exe 1096 "C:\Windows\SysWOW64\vprs.exe"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:2104
        
        C:\Windows\SysWOW64\sqkf.exe
        
        C:\Windows\system32\sqkf.exe 1088 "C:\Windows\SysWOW64\frhc.exe"
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Windows\SysWOW64\fgei.exe
        
        C:\Windows\system32\fgei.exe 1104 "C:\Windows\SysWOW64\sqkf.exe"
        103⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\sfzk.exe
        
        C:\Windows\system32\sfzk.exe 1100 "C:\Windows\SysWOW64\fgei.exe"
        104⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\blaa.exe
        
        C:\Windows\system32\blaa.exe 1108 "C:\Windows\SysWOW64\sfzk.exe"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Windows\SysWOW64\ojvc.exe
        
        C:\Windows\system32\ojvc.exe 1112 "C:\Windows\SysWOW64\blaa.exe"
        106⤵
        Identifies Wine through registry keys
        
        PID:2232
        
        C:\Windows\SysWOW64\bayf.exe
        
        C:\Windows\system32\bayf.exe 1116 "C:\Windows\SysWOW64\ojvc.exe"
        107⤵
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Windows\SysWOW64\oysi.exe
        
        C:\Windows\system32\oysi.exe 1120 "C:\Windows\SysWOW64\bayf.exe"
        108⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\ybis.exe
        
        C:\Windows\system32\ybis.exe 1128 "C:\Windows\SysWOW64\oysi.exe"
        109⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\lrlv.exe
        
        C:\Windows\system32\lrlv.exe 1124 "C:\Windows\SysWOW64\ybis.exe"
        110⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1476
        
        C:\Windows\SysWOW64\yqfy.exe
        
        C:\Windows\system32\yqfy.exe 1132 "C:\Windows\SysWOW64\lrlv.exe"
        111⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\lgaa.exe
        
        C:\Windows\system32\lgaa.exe 1136 "C:\Windows\SysWOW64\yqfy.exe"
        112⤵
        Identifies Wine through registry keys
        
        PID:1292
        
        C:\Windows\SysWOW64\uvbq.exe
        
        C:\Windows\system32\uvbq.exe 1144 "C:\Windows\SysWOW64\lgaa.exe"
        113⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\hlws.exe
        
        C:\Windows\system32\hlws.exe 1140 "C:\Windows\SysWOW64\uvbq.exe"
        114⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\ukyv.exe
        
        C:\Windows\system32\ukyv.exe 1152 "C:\Windows\SysWOW64\hlws.exe"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Windows\SysWOW64\haty.exe
        
        C:\Windows\system32\haty.exe 1008 "C:\Windows\SysWOW64\ukyv.exe"
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\uzoa.exe
        
        C:\Windows\system32\uzoa.exe 1160 "C:\Windows\SysWOW64\haty.exe"
        117⤵
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Windows\SysWOW64\efpy.exe
        
        C:\Windows\system32\efpy.exe 1156 "C:\Windows\SysWOW64\uzoa.exe"
        118⤵
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Windows\SysWOW64\rdra.exe
        
        C:\Windows\system32\rdra.exe 1164 "C:\Windows\SysWOW64\efpy.exe"
        119⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\dumd.exe
        
        C:\Windows\system32\dumd.exe 1168 "C:\Windows\SysWOW64\rdra.exe"
        120⤵
        Identifies Wine through registry keys
        
        PID:2308
        
        C:\Windows\SysWOW64\qshg.exe
        
        C:\Windows\system32\qshg.exe 1176 "C:\Windows\SysWOW64\dumd.exe"
        121⤵
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\djkj.exe
        
        C:\Windows\system32\djkj.exe 1172 "C:\Windows\SysWOW64\qshg.exe"
        122⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\nxly.exe
        
        C:\Windows\system32\nxly.exe 1180 "C:\Windows\SysWOW64\djkj.exe"
        123⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1780
        
        C:\Windows\SysWOW64\anfb.exe
        
        C:\Windows\system32\anfb.exe 1184 "C:\Windows\SysWOW64\nxly.exe"
        124⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\nmad.exe
        
        C:\Windows\system32\nmad.exe 1200 "C:\Windows\SysWOW64\anfb.exe"
        125⤵
        Drops file in System32 directory
        
        PID:1168
        
        C:\Windows\SysWOW64\acdg.exe
        
        C:\Windows\system32\acdg.exe 1188 "C:\Windows\SysWOW64\nmad.exe"
        126⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\ntyj.exe
        
        C:\Windows\system32\ntyj.exe 1196 "C:\Windows\SysWOW64\acdg.exe"
        127⤵
        Identifies Wine through registry keys
        
        PID:1108
        
        C:\Windows\SysWOW64\whyg.exe
        
        C:\Windows\system32\whyg.exe 1192 "C:\Windows\SysWOW64\ntyj.exe"
        128⤵
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\jftb.exe
        
        C:\Windows\system32\jftb.exe 1204 "C:\Windows\SysWOW64\whyg.exe"
        129⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\wwod.exe
        
        C:\Windows\system32\wwod.exe 1208 "C:\Windows\SysWOW64\jftb.exe"
        130⤵
        Identifies Wine through registry keys
        
        PID:1812
        
        C:\Windows\SysWOW64\jmrg.exe
        
        C:\Windows\system32\jmrg.exe 1212 "C:\Windows\SysWOW64\wwod.exe"
        131⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Windows\SysWOW64\wlmj.exe
        
        C:\Windows\system32\wlmj.exe 1216 "C:\Windows\SysWOW64\jmrg.exe"
        132⤵
        
        PID:780
        
        C:\Windows\SysWOW64\gzmg.exe
        
        C:\Windows\system32\gzmg.exe 1232 "C:\Windows\SysWOW64\wlmj.exe"
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Windows\SysWOW64\sphj.exe
        
        C:\Windows\system32\sphj.exe 1220 "C:\Windows\SysWOW64\gzmg.exe"
        134⤵
        Identifies Wine through registry keys
        
        PID:2440
        
        C:\Windows\SysWOW64\fgkm.exe
        
        C:\Windows\system32\fgkm.exe 1228 "C:\Windows\SysWOW64\sphj.exe"
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\sefo.exe
        
        C:\Windows\system32\sefo.exe 1224 "C:\Windows\SysWOW64\fgkm.exe"
        136⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\fvzr.exe
        
        C:\Windows\system32\fvzr.exe 1236 "C:\Windows\SysWOW64\sefo.exe"
        137⤵
        Drops file in System32 directory
        
        PID:1020
        
        C:\Windows\SysWOW64\pjag.exe
        
        C:\Windows\system32\pjag.exe 1240 "C:\Windows\SysWOW64\fvzr.exe"
        138⤵
        Drops file in System32 directory
        
        PID:2668
        
        C:\Windows\SysWOW64\czvj.exe
        
        C:\Windows\system32\czvj.exe 1244 "C:\Windows\SysWOW64\pjag.exe"
        139⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\pyym.exe
        
        C:\Windows\system32\pyym.exe 1148 "C:\Windows\SysWOW64\czvj.exe"
        140⤵
        Drops file in System32 directory
        
        PID:2908
        
        C:\Windows\SysWOW64\coto.exe
        
        C:\Windows\system32\coto.exe 1264 "C:\Windows\SysWOW64\pyym.exe"
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\onnr.exe
        
        C:\Windows\system32\onnr.exe 1252 "C:\Windows\SysWOW64\coto.exe"
        142⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\ytoo.exe
        
        C:\Windows\system32\ytoo.exe 1260 "C:\Windows\SysWOW64\onnr.exe"
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:264
        
        C:\Windows\SysWOW64\lsrr.exe
        
        C:\Windows\system32\lsrr.exe 1256 "C:\Windows\SysWOW64\ytoo.exe"
        144⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\yimm.exe
        
        C:\Windows\system32\yimm.exe 1272 "C:\Windows\SysWOW64\lsrr.exe"
        145⤵
        Identifies Wine through registry keys
        
        PID:1772
        
        C:\Windows\SysWOW64\lggp.exe
        
        C:\Windows\system32\lggp.exe 1268 "C:\Windows\SysWOW64\yimm.exe"
        146⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\yxjr.exe
        
        C:\Windows\system32\yxjr.exe 1280 "C:\Windows\SysWOW64\lggp.exe"
        147⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\hlcp.exe
        
        C:\Windows\system32\hlcp.exe 1276 "C:\Windows\SysWOW64\yxjr.exe"
        148⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:1524
        
        C:\Windows\SysWOW64\ucfr.exe
        
        C:\Windows\system32\ucfr.exe 1288 "C:\Windows\SysWOW64\hlcp.exe"
        149⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\zazu.exe
        
        C:\Windows\system32\zazu.exe 1284 "C:\Windows\SysWOW64\ucfr.exe"
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Windows\SysWOW64\mrux.exe
        
        C:\Windows\system32\mrux.exe 1292 "C:\Windows\SysWOW64\zazu.exe"
        151⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\zhxz.exe
        
        C:\Windows\system32\zhxz.exe 1296 "C:\Windows\SysWOW64\mrux.exe"
        152⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\jvyp.exe
        
        C:\Windows\system32\jvyp.exe 1300 "C:\Windows\SysWOW64\zhxz.exe"
        153⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\wusr.exe
        
        C:\Windows\system32\wusr.exe 1304 "C:\Windows\SysWOW64\jvyp.exe"
        154⤵
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\jknu.exe
        
        C:\Windows\system32\jknu.exe 1312 "C:\Windows\SysWOW64\wusr.exe"
        155⤵
        Drops file in System32 directory
        
        PID:2076
        
        C:\Windows\SysWOW64\snle.exe
        
        C:\Windows\system32\snle.exe 1308 "C:\Windows\SysWOW64\jknu.exe"
        156⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\flfh.exe
        
        C:\Windows\system32\flfh.exe 1320 "C:\Windows\SysWOW64\snle.exe"
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\scak.exe
        
        C:\Windows\system32\scak.exe 1316 "C:\Windows\SysWOW64\flfh.exe"
        158⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\favn.exe
        
        C:\Windows\system32\favn.exe 1336 "C:\Windows\SysWOW64\scak.exe"
        159⤵
        Identifies Wine through registry keys
        
        PID:112
        
        C:\Windows\SysWOW64\sryp.exe
        
        C:\Windows\system32\sryp.exe 1324 "C:\Windows\SysWOW64\favn.exe"
        160⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\fpts.exe
        
        C:\Windows\system32\fpts.exe 1248 "C:\Windows\SysWOW64\sryp.exe"
        161⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\pvth.exe
        
        C:\Windows\system32\pvth.exe 1332 "C:\Windows\SysWOW64\fpts.exe"
        162⤵
        Identifies Wine through registry keys
        
        PID:2648
        
        C:\Windows\SysWOW64\cuok.exe
        
        C:\Windows\system32\cuok.exe 1340 "C:\Windows\SysWOW64\pvth.exe"
        163⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:2596
        
        C:\Windows\SysWOW64\okrn.exe
        
        C:\Windows\system32\okrn.exe 1344 "C:\Windows\SysWOW64\cuok.exe"
        164⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\bjmp.exe
        
        C:\Windows\system32\bjmp.exe 1348 "C:\Windows\SysWOW64\okrn.exe"
        165⤵
        Identifies Wine through registry keys
        
        PID:2720
        
        C:\Windows\SysWOW64\ozhs.exe
        
        C:\Windows\system32\ozhs.exe 1352 "C:\Windows\SysWOW64\bjmp.exe"
        166⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:1012
        
        C:\Windows\SysWOW64\ynhp.exe
        
        C:\Windows\system32\ynhp.exe 1356 "C:\Windows\SysWOW64\ozhs.exe"
        167⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\leks.exe
        
        C:\Windows\system32\leks.exe 1360 "C:\Windows\SysWOW64\ynhp.exe"
        168⤵
        Drops file in System32 directory
        
        PID:2580
        
        C:\Windows\SysWOW64\ycfv.exe
        
        C:\Windows\system32\ycfv.exe 1368 "C:\Windows\SysWOW64\leks.exe"
        169⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\ltax.exe
        
        C:\Windows\system32\ltax.exe 1364 "C:\Windows\SysWOW64\ycfv.exe"
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Windows\SysWOW64\yjca.exe
        
        C:\Windows\system32\yjca.exe 1376 "C:\Windows\SysWOW64\ltax.exe"
        171⤵
        Identifies Wine through registry keys
        
        PID:2748
        
        C:\Windows\SysWOW64\hxvq.exe
        
        C:\Windows\system32\hxvq.exe 1372 "C:\Windows\SysWOW64\yjca.exe"
        172⤵
        Identifies Wine through registry keys
        
        PID:2052
        
        C:\Windows\SysWOW64\uoys.exe
        
        C:\Windows\system32\uoys.exe 1392 "C:\Windows\SysWOW64\hxvq.exe"
        173⤵
        Drops file in System32 directory
        
        PID:2276
        
        C:\Windows\SysWOW64\hmtv.exe
        
        C:\Windows\system32\hmtv.exe 1384 "C:\Windows\SysWOW64\uoys.exe"
        174⤵
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\udoy.exe
        
        C:\Windows\system32\udoy.exe 1380 "C:\Windows\SysWOW64\hmtv.exe"
        175⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\hbqa.exe
        
        C:\Windows\system32\hbqa.exe 1388 "C:\Windows\SysWOW64\udoy.exe"
        176⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\riry.exe
        
        C:\Windows\system32\riry.exe 1396 "C:\Windows\SysWOW64\hbqa.exe"
        177⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\dgms.exe
        
        C:\Windows\system32\dgms.exe 1400 "C:\Windows\SysWOW64\riry.exe"
        178⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:1960
        
        C:\Windows\SysWOW64\qxhv.exe
        
        C:\Windows\system32\qxhv.exe 1408 "C:\Windows\SysWOW64\dgms.exe"
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\dvjy.exe
        
        C:\Windows\system32\dvjy.exe 1404 "C:\Windows\SysWOW64\qxhv.exe"
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Windows\SysWOW64\qmea.exe
        
        C:\Windows\system32\qmea.exe 1412 "C:\Windows\SysWOW64\dvjy.exe"
        181⤵
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Windows\SysWOW64\awul.exe
        
        C:\Windows\system32\awul.exe 1328 "C:\Windows\SysWOW64\qmea.exe"
        182⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\nnoo.exe
        
        C:\Windows\system32\nnoo.exe 1416 "C:\Windows\SysWOW64\awul.exe"
        183⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\apud.exe
        
        C:\Windows\system32\apud.exe 1424 "C:\Windows\SysWOW64\nnoo.exe"
        184⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\nfxg.exe
        
        C:\Windows\system32\nfxg.exe 1428 "C:\Windows\SysWOW64\apud.exe"
        185⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\aesj.exe
        
        C:\Windows\system32\aesj.exe 1432 "C:\Windows\SysWOW64\nfxg.exe"
        186⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:2504
        
        C:\Windows\SysWOW64\jkty.exe
        
        C:\Windows\system32\jkty.exe 1436 "C:\Windows\SysWOW64\aesj.exe"
        187⤵
        Drops file in System32 directory
        
        PID:1368
        
        C:\Windows\SysWOW64\winb.exe
        
        C:\Windows\system32\winb.exe 1440 "C:\Windows\SysWOW64\jkty.exe"
        188⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Windows\SysWOW64\jzqd.exe
        
        C:\Windows\system32\jzqd.exe 1448 "C:\Windows\SysWOW64\winb.exe"
        189⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\wplg.exe
        
        C:\Windows\system32\wplg.exe 1444 "C:\Windows\SysWOW64\jzqd.exe"
        190⤵
        
        PID:904
        
        C:\Windows\SysWOW64\jogj.exe
        
        C:\Windows\system32\jogj.exe 1456 "C:\Windows\SysWOW64\wplg.exe"
        191⤵
        Identifies Wine through registry keys
        
        PID:396
        
        C:\Windows\SysWOW64\schg.exe
        
        C:\Windows\system32\schg.exe 1452 "C:\Windows\SysWOW64\jogj.exe"
        192⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\fsjj.exe
        
        C:\Windows\system32\fsjj.exe 1464 "C:\Windows\SysWOW64\schg.exe"
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Windows\SysWOW64\sjed.exe
        
        C:\Windows\system32\sjed.exe 1460 "C:\Windows\SysWOW64\fsjj.exe"
        194⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\fhzg.exe
        
        C:\Windows\system32\fhzg.exe 1468 "C:\Windows\SysWOW64\sjed.exe"
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Windows\SysWOW64\sycj.exe
        
        C:\Windows\system32\sycj.exe 1472 "C:\Windows\SysWOW64\fhzg.exe"
        196⤵
        
        PID:832
        
        C:\Windows\SysWOW64\cmug.exe
        
        C:\Windows\system32\cmug.exe 1476 "C:\Windows\SysWOW64\sycj.exe"
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Windows\SysWOW64\pcxj.exe
        
        C:\Windows\system32\pcxj.exe 1480 "C:\Windows\SysWOW64\cmug.exe"
        198⤵
        Drops file in System32 directory
        
        PID:1804
        
        C:\Windows\SysWOW64\uxhz.exe
        
        C:\Windows\system32\uxhz.exe 1496 "C:\Windows\SysWOW64\pcxj.exe"
        199⤵
        
        PID:856
        
        C:\Windows\SysWOW64\ddhw.exe
        
        C:\Windows\system32\ddhw.exe 1484 "C:\Windows\SysWOW64\uxhz.exe"
        200⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\qckz.exe
        
        C:\Windows\system32\qckz.exe 1492 "C:\Windows\SysWOW64\ddhw.exe"
        201⤵
        
        PID:896
        
        C:\Windows\SysWOW64\dsfb.exe
        
        C:\Windows\system32\dsfb.exe 1488 "C:\Windows\SysWOW64\qckz.exe"
        202⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\qrae.exe
        
        C:\Windows\system32\qrae.exe 1512 "C:\Windows\SysWOW64\dsfb.exe"
        203⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\aupg.exe
        
        C:\Windows\system32\aupg.exe 1500 "C:\Windows\SysWOW64\qrae.exe"
        204⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\nksj.exe
        
        C:\Windows\system32\nksj.exe 1508 "C:\Windows\SysWOW64\aupg.exe"
        205⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        
        PID:2916
        
        C:\Windows\SysWOW64\ajnm.exe
        
        C:\Windows\system32\ajnm.exe 1504 "C:\Windows\SysWOW64\nksj.exe"
        206⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\nzio.exe
        
        C:\Windows\system32\nzio.exe 1528 "C:\Windows\SysWOW64\ajnm.exe"
        207⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\wnim.exe
        
        C:\Windows\system32\wnim.exe 1516 "C:\Windows\SysWOW64\nzio.exe"
        208⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\jelp.exe
        
        C:\Windows\system32\jelp.exe 1520 "C:\Windows\SysWOW64\wnim.exe"
        209⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\wcgr.exe
        
        C:\Windows\system32\wcgr.exe 1524 "C:\Windows\SysWOW64\jelp.exe"
        210⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\jtbu.exe
        
        C:\Windows\system32\jtbu.exe 1532 "C:\Windows\SysWOW64\wcgr.exe"
        211⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\wrdx.exe
        
        C:\Windows\system32\wrdx.exe 1536 "C:\Windows\SysWOW64\jtbu.exe"
        212⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\gxwm.exe
        
        C:\Windows\system32\gxwm.exe 1544 "C:\Windows\SysWOW64\wrdx.exe"
        213⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\twzp.exe
        
        C:\Windows\system32\twzp.exe 1540 "C:\Windows\SysWOW64\gxwm.exe"
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Windows\SysWOW64\gmur.exe
        
        C:\Windows\system32\gmur.exe 1556 "C:\Windows\SysWOW64\twzp.exe"
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\tlpu.exe
        
        C:\Windows\system32\tlpu.exe 1548 "C:\Windows\SysWOW64\gmur.exe"
        216⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\fbrx.exe
        
        C:\Windows\system32\fbrx.exe 1560 "C:\Windows\SysWOW64\tlpu.exe"
        217⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\ppsu.exe
        
        C:\Windows\system32\ppsu.exe 1552 "C:\Windows\SysWOW64\fbrx.exe"
        218⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\cgnx.exe
        
        C:\Windows\system32\cgnx.exe 1564 "C:\Windows\SysWOW64\ppsu.exe"
        219⤵
        
        PID:968
        
        C:\Windows\SysWOW64\peir.exe
        
        C:\Windows\system32\peir.exe 1568 "C:\Windows\SysWOW64\cgnx.exe"
        220⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\cvku.exe
        
        C:\Windows\system32\cvku.exe 1576 "C:\Windows\SysWOW64\peir.exe"
        221⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Windows\SysWOW64\plfx.exe
        
        C:\Windows\system32\plfx.exe 1572 "C:\Windows\SysWOW64\cvku.exe"
        222⤵
        Drops file in System32 directory
        
        PID:1740
        
        C:\Windows\SysWOW64\yzgu.exe
        
        C:\Windows\system32\yzgu.exe 1588 "C:\Windows\SysWOW64\plfx.exe"
        223⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\lybx.exe
        
        C:\Windows\system32\lybx.exe 1580 "C:\Windows\SysWOW64\yzgu.exe"
        224⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\ylsn.exe
        
        C:\Windows\system32\ylsn.exe 1592 "C:\Windows\SysWOW64\lybx.exe"
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\iztk.exe
        
        C:\Windows\system32\iztk.exe 1584 "C:\Windows\SysWOW64\ylsn.exe"
        226⤵
        Identifies Wine through registry keys
        
        PID:992
        
        C:\Windows\SysWOW64\vpon.exe
        
        C:\Windows\system32\vpon.exe 1596 "C:\Windows\SysWOW64\iztk.exe"
        227⤵
        Identifies Wine through registry keys
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\igip.exe
        
        C:\Windows\system32\igip.exe 1600 "C:\Windows\SysWOW64\vpon.exe"
        228⤵
        Drops file in System32 directory
        
        PID:1548
        
        C:\Windows\SysWOW64\vels.exe
        
        C:\Windows\system32\vels.exe 1604 "C:\Windows\SysWOW64\igip.exe"
        229⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\ivgn.exe
        
        C:\Windows\system32\ivgn.exe 1608 "C:\Windows\SysWOW64\vels.exe"
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Windows\SysWOW64\rjhk.exe
        
        C:\Windows\system32\rjhk.exe 1624 "C:\Windows\SysWOW64\ivgn.exe"
        231⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\ezcn.exe
        
        C:\Windows\system32\ezcn.exe 1612 "C:\Windows\SysWOW64\rjhk.exe"
        232⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\rywq.exe
        
        C:\Windows\system32\rywq.exe 1616 "C:\Windows\SysWOW64\ezcn.exe"
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Windows\SysWOW64\eozs.exe
        
        C:\Windows\system32\eozs.exe 1620 "C:\Windows\SysWOW64\rywq.exe"
        234⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\rnuv.exe
        
        C:\Windows\system32\rnuv.exe 1628 "C:\Windows\SysWOW64\eozs.exe"
        235⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\btvk.exe
        
        C:\Windows\system32\btvk.exe 1632 "C:\Windows\SysWOW64\rnuv.exe"
        236⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\ospn.exe
        
        C:\Windows\system32\ospn.exe 1644 "C:\Windows\SysWOW64\btvk.exe"
        237⤵
        Drops file in System32 directory
        
        PID:2160
        
        C:\Windows\SysWOW64\bisq.exe
        
        C:\Windows\system32\bisq.exe 1636 "C:\Windows\SysWOW64\ospn.exe"
        238⤵
        Drops file in System32 directory
        
        PID:2252
        
        C:\Windows\SysWOW64\nhns.exe
        
        C:\Windows\system32\nhns.exe 1648 "C:\Windows\SysWOW64\bisq.exe"
        239⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:932
        
        C:\Windows\SysWOW64\axiv.exe
        
        C:\Windows\system32\axiv.exe 1640 "C:\Windows\SysWOW64\nhns.exe"
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Windows\SysWOW64\klis.exe
        
        C:\Windows\system32\klis.exe 1652 "C:\Windows\SysWOW64\axiv.exe"
        241⤵
        Identifies Wine through registry keys
        
        PID:2872
        
        C:\Windows\SysWOW64\xclv.exe
        
        C:\Windows\system32\xclv.exe 1656 "C:\Windows\SysWOW64\klis.exe"
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Windows\SysWOW64\kpvl.exe
        
        C:\Windows\system32\kpvl.exe 1664 "C:\Windows\SysWOW64\xclv.exe"
        243⤵
        System Location Discovery: System Language Discovery
        
        PID:956
        
        C:\Windows\SysWOW64\udvi.exe
        
        C:\Windows\system32\udvi.exe 1660 "C:\Windows\SysWOW64\kpvl.exe"
        244⤵
        Identifies Wine through registry keys
        
        PID:2912
        
        C:\Windows\SysWOW64\htql.exe
        
        C:\Windows\system32\htql.exe 1676 "C:\Windows\SysWOW64\udvi.exe"
        245⤵
        Identifies Wine through registry keys
        
        PID:2164
        
        C:\Windows\SysWOW64\ustg.exe
        
        C:\Windows\system32\ustg.exe 1668 "C:\Windows\SysWOW64\htql.exe"
        246⤵
        Drops file in System32 directory
        
        PID:2572
        
        C:\Windows\SysWOW64\duiq.exe
        
        C:\Windows\system32\duiq.exe 1420 "C:\Windows\SysWOW64\ustg.exe"
        247⤵
        Identifies Wine through registry keys
        
        PID:2620
        
        C:\Windows\SysWOW64\lhjl.exe
        
        C:\Windows\system32\lhjl.exe 1680 "C:\Windows\SysWOW64\duiq.exe"
        248⤵
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        C:\Windows\SysWOW64\vnji.exe
        
        C:\Windows\system32\vnji.exe 1696 "C:\Windows\SysWOW64\lhjl.exe"
        249⤵
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\ilml.exe
        
        C:\Windows\system32\ilml.exe 1684 "C:\Windows\SysWOW64\vnji.exe"
        250⤵
        Identifies Wine through registry keys
        
        PID:1520
        
        C:\Windows\SysWOW64\vcho.exe
        
        C:\Windows\system32\vcho.exe 1688 "C:\Windows\SysWOW64\ilml.exe"
        251⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Windows\SysWOW64\iacq.exe
        
        C:\Windows\system32\iacq.exe 1692 "C:\Windows\SysWOW64\vcho.exe"
        252⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\vrft.exe
        
        C:\Windows\system32\vrft.exe 1700 "C:\Windows\SysWOW64\iacq.exe"
        253⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\efxi.exe
        
        C:\Windows\system32\efxi.exe 1704 "C:\Windows\SysWOW64\vrft.exe"
        254⤵
        Identifies Wine through registry keys
        
        PID:2924
        
        C:\Windows\SysWOW64\rval.exe
        
        C:\Windows\system32\rval.exe 1708 "C:\Windows\SysWOW64\efxi.exe"
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Windows\SysWOW64\euvo.exe
        
        C:\Windows\system32\euvo.exe 1672 "C:\Windows\SysWOW64\rval.exe"
        256⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\rkqq.exe
        
        C:\Windows\system32\rkqq.exe 1720 "C:\Windows\SysWOW64\euvo.exe"
        257⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\ebst.exe
        
        C:\Windows\system32\ebst.exe 1716 "C:\Windows\SysWOW64\rkqq.exe"
        258⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\optr.exe
        
        C:\Windows\system32\optr.exe 1736 "C:\Windows\SysWOW64\ebst.exe"
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:532
        
        C:\Windows\SysWOW64\bnot.exe
        
        C:\Windows\system32\bnot.exe 1724 "C:\Windows\SysWOW64\optr.exe"
        260⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\nejw.exe
        
        C:\Windows\system32\nejw.exe 1728 "C:\Windows\SysWOW64\bnot.exe"
        261⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\aulr.exe
        
        C:\Windows\system32\aulr.exe 1732 "C:\Windows\SysWOW64\nejw.exe"
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
        
        C:\Windows\SysWOW64\ntgt.exe
        
        C:\Windows\system32\ntgt.exe 1748 "C:\Windows\SysWOW64\aulr.exe"
        263⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\xhhr.exe
        
        C:\Windows\system32\xhhr.exe 1740 "C:\Windows\SysWOW64\ntgt.exe"
        264⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\kyct.exe
        
        C:\Windows\system32\kyct.exe 1760 "C:\Windows\SysWOW64\xhhr.exe"
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\xoww.exe
        
        C:\Windows\system32\xoww.exe 1744 "C:\Windows\SysWOW64\kyct.exe"
        266⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\knzz.exe
        
        C:\Windows\system32\knzz.exe 1752 "C:\Windows\SysWOW64\xoww.exe"
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Windows\SysWOW64\xdub.exe
        
        C:\Windows\system32\xdub.exe 1756 "C:\Windows\SysWOW64\knzz.exe"
        268⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\grvr.exe
        
        C:\Windows\system32\grvr.exe 1776 "C:\Windows\SysWOW64\xdub.exe"
        269⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\tiqu.exe
        
        C:\Windows\system32\tiqu.exe 1764 "C:\Windows\SysWOW64\grvr.exe"
        270⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\ggsw.exe
        
        C:\Windows\system32\ggsw.exe 1772 "C:\Windows\SysWOW64\tiqu.exe"
        271⤵
        Drops file in System32 directory
        
        PID:404
        
        C:\Windows\SysWOW64\txnz.exe
        
        C:\Windows\system32\txnz.exe 1768 "C:\Windows\SysWOW64\ggsw.exe"
        272⤵
        Identifies Wine through registry keys
        
        PID:1220
        
        C:\Windows\SysWOW64\gvic.exe
        
        C:\Windows\system32\gvic.exe 1712 "C:\Windows\SysWOW64\txnz.exe"
        273⤵
        Identifies Wine through registry keys
        
        PID:3056
        
        C:\Windows\SysWOW64\qbjz.exe
        
        C:\Windows\system32\qbjz.exe 1784 "C:\Windows\SysWOW64\gvic.exe"
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Windows\SysWOW64\calc.exe
        
        C:\Windows\system32\calc.exe 1788 "C:\Windows\SysWOW64\qbjz.exe"
        275⤵
        
        PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dbel.exe

Filesize
526KB

MD5
007f1600b0a0777c591f415db8ec29a3

SHA1
76bc884c55c46fa51b804dfc5f6d5a0a2135b9a2

SHA256
cb7c957512e28316854bf79037d88cdd7e349f43340d80ba53668e7974a4cb82

SHA512
b2656f206e161888fe3f798bf757ab6cd95b49424da6219d70ae866e1db52f3f826bb5c647a510b4c9e78d1bc2db05e67b40763b04ffdf3a8818fed1e04bddc4

Download Submit
memory/276-34-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/276-50-0x00000000048D0000-0x0000000004AA9000-memory.dmp

Filesize
1.8MB

Download
memory/276-47-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/276-48-0x00000000048D0000-0x0000000004AA9000-memory.dmp

Filesize
1.8MB

Download
memory/276-42-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/276-36-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/300-259-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/372-471-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/376-110-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/376-106-0x0000000004800000-0x00000000049D9000-memory.dmp

Filesize
1.8MB

Download
memory/376-107-0x0000000004800000-0x00000000049D9000-memory.dmp

Filesize
1.8MB

Download
memory/376-95-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/440-187-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/440-163-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/568-464-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/632-165-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/632-150-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/632-162-0x00000000048C0000-0x0000000004A99000-memory.dmp

Filesize
1.8MB

Download
memory/708-228-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/708-213-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/988-287-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1176-335-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1240-377-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1300-506-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1408-199-0x00000000048A0000-0x0000000004A79000-memory.dmp

Filesize
1.8MB

Download
memory/1408-202-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1436-555-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1516-307-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1544-478-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1576-535-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1616-420-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1692-236-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1692-226-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1728-16-0x0000000004880000-0x0000000004A59000-memory.dmp

Filesize
1.8MB

Download
memory/1728-13-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1728-2-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1728-15-0x0000000004880000-0x0000000004A59000-memory.dmp

Filesize
1.8MB

Download
memory/1728-0-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1728-1-0x0000000000401000-0x0000000000429000-memory.dmp

Filesize
160KB

Download
memory/1728-6-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1760-541-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1800-356-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1924-412-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2036-450-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2044-548-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2068-391-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2084-398-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2088-57-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2088-66-0x0000000004910000-0x0000000004AE9000-memory.dmp

Filesize
1.8MB

Download
memory/2088-51-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2088-53-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2088-58-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2088-67-0x0000000004910000-0x0000000004AE9000-memory.dmp

Filesize
1.8MB

Download
memory/2100-436-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2128-513-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2136-83-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2136-80-0x0000000004810000-0x00000000049E9000-memory.dmp

Filesize
1.8MB

Download
memory/2136-68-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2196-527-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2204-349-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2240-212-0x0000000004830000-0x0000000004A09000-memory.dmp

Filesize
1.8MB

Download
memory/2240-215-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2268-300-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2340-405-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2360-457-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2364-272-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2380-266-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2384-124-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2384-121-0x00000000048A0000-0x0000000004A79000-memory.dmp

Filesize
1.8MB

Download
memory/2384-122-0x00000000048A0000-0x0000000004A79000-memory.dmp

Filesize
1.8MB

Download
memory/2392-419-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2444-564-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2512-293-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2584-192-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2588-251-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2636-520-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2656-492-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2660-499-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2688-314-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2700-144-0x00000000048B0000-0x0000000004A89000-memory.dmp

Filesize
1.8MB

Download
memory/2700-151-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2700-136-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2708-443-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2728-138-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2728-123-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2728-134-0x0000000004810000-0x00000000049E9000-memory.dmp

Filesize
1.8MB

Download
memory/2736-31-0x00000000048B0000-0x0000000004A89000-memory.dmp

Filesize
1.8MB

Download
memory/2736-17-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2736-19-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2736-33-0x00000000048B0000-0x0000000004A89000-memory.dmp

Filesize
1.8MB

Download
memory/2736-24-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2736-23-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2764-384-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2788-429-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2824-370-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2836-342-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2848-321-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2868-279-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2876-485-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2892-246-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2896-328-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2980-96-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2980-81-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2980-93-0x0000000004800000-0x00000000049D9000-memory.dmp

Filesize
1.8MB

Download
memory/3048-363-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads