Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe
-
Size
526KB
-
MD5
007f1600b0a0777c591f415db8ec29a3
-
SHA1
76bc884c55c46fa51b804dfc5f6d5a0a2135b9a2
-
SHA256
cb7c957512e28316854bf79037d88cdd7e349f43340d80ba53668e7974a4cb82
-
SHA512
b2656f206e161888fe3f798bf757ab6cd95b49424da6219d70ae866e1db52f3f826bb5c647a510b4c9e78d1bc2db05e67b40763b04ffdf3a8818fed1e04bddc4
-
SSDEEP
12288:SHN3d5HDR40EFZjLDLuluC89Ew5nph2rxxnew80aEL1c0nb4auvhGzY:SHv5jRfEnXiuB9cDeCaERh4a98
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Executes dropped EXE 64 IoCs
pid Process 2736 dbel.exe 276 uidi.exe 2088 krqa.exe 2136 zcvg.exe 2980 fgvd.exe 376 fshw.exe 2384 fkqo.exe 2728 hbww.exe 2700 wzdw.exe 632 blxe.exe 440 dzzg.exe 2584 doxm.exe 1408 shug.exe 2240 zphz.exe 708 hqgz.exe 1692 mjwz.exe 2892 myme.exe 2588 dnkj.exe 300 omph.exe 2380 bzge.exe 2364 ljvh.exe 2868 viim.exe 988 izcp.exe 2512 phqh.exe 2268 cftk.exe 1516 jqrp.exe 2688 wpmr.exe 2848 goyp.exe 2896 tets.exe 1176 dlfp.exe 2836 novz.exe 2204 ykns.exe 1800 kaqn.exe 3048 stpa.exe 2824 fkkc.exe 1240 pjwa.exe 2764 chrc.exe 2068 mdsn.exe 2084 wrsk.exe 2340 gqwi.exe 1924 thrk.exe 2392 dgdi.exe 1616 qeyk.exe 2100 ncfl.exe 2708 xeuv.exe 2036 jgal.exe 2360 wxvf.exe 568 jnyi.exe 372 ujza.exe 1544 vxsq.exe 2876 ikjn.exe 2656 vmpv.exe 2660 fltt.exe 1300 snhi.exe 2128 cjab.exe 2636 mlqd.exe 2196 wsci.exe 1576 jmiq.exe 1760 tumo.exe 2044 ghdl.exe 1436 qgij.exe 2444 dioq.exe 1828 nklb.exe 2884 axvy.exe -
Identifies Wine through registry keys 2 TTPs 64 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine dumd.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine wwod.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine bjmp.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine ncfl.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine jnyi.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine dioq.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine axvy.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine fxwm.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine winb.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine stpa.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine vnjm.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine ojvc.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine krqa.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine wzdw.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine pjwa.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine swro.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine vpon.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine jgal.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine mzio.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine yjca.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine jogj.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine klis.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine bayf.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine htql.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine duiq.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine gvic.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine uqgm.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine lrlv.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine efpy.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine lhjl.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine cuok.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine nksj.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine efxi.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine viim.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine xdlm.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine lgaa.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine hlcp.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine favn.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine hgjp.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine yimm.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine udvi.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine ozhs.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine qmea.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine doxm.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine wxvf.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine ikjn.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine ntyj.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine dgms.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine iztk.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine vxsq.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine ilml.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine fkqo.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine mvnl.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine hxvq.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine txnz.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine uzoa.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine sphj.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine pvth.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine fgvd.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine fshw.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine fltt.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine iedo.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine vjww.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine aesj.exe -
Loads dropped DLL 64 IoCs
pid Process 1728 JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe 1728 JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe 2736 dbel.exe 2736 dbel.exe 276 uidi.exe 276 uidi.exe 2088 krqa.exe 2088 krqa.exe 2136 zcvg.exe 2136 zcvg.exe 2980 fgvd.exe 2980 fgvd.exe 376 fshw.exe 376 fshw.exe 2384 fkqo.exe 2384 fkqo.exe 2728 hbww.exe 2728 hbww.exe 2700 wzdw.exe 2700 wzdw.exe 632 blxe.exe 632 blxe.exe 440 dzzg.exe 440 dzzg.exe 2584 doxm.exe 2584 doxm.exe 1408 shug.exe 1408 shug.exe 2240 zphz.exe 2240 zphz.exe 708 hqgz.exe 708 hqgz.exe 1692 mjwz.exe 1692 mjwz.exe 2892 myme.exe 2892 myme.exe 2588 dnkj.exe 2588 dnkj.exe 300 omph.exe 300 omph.exe 2380 bzge.exe 2380 bzge.exe 2364 ljvh.exe 2364 ljvh.exe 2868 viim.exe 2868 viim.exe 988 izcp.exe 988 izcp.exe 2512 phqh.exe 2512 phqh.exe 2268 cftk.exe 2268 cftk.exe 1516 jqrp.exe 1516 jqrp.exe 2688 wpmr.exe 2688 wpmr.exe 2848 goyp.exe 2848 goyp.exe 2896 tets.exe 2896 tets.exe 1176 dlfp.exe 1176 dlfp.exe 2836 novz.exe 2836 novz.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\yqfy.exe lrlv.exe File created C:\Windows\SysWOW64\ynhp.exe ozhs.exe File created C:\Windows\SysWOW64\ilml.exe vnji.exe File created C:\Windows\SysWOW64\txnz.exe ggsw.exe File opened for modification C:\Windows\SysWOW64\mkkj.exe zuqo.exe File opened for modification C:\Windows\SysWOW64\snhi.exe fltt.exe File opened for modification C:\Windows\SysWOW64\uidi.exe dbel.exe File created C:\Windows\SysWOW64\jkty.exe aesj.exe File opened for modification C:\Windows\SysWOW64\ajnm.exe nksj.exe File opened for modification C:\Windows\SysWOW64\ywnh.exe lyse.exe File created C:\Windows\SysWOW64\knqk.exe ywnh.exe File created C:\Windows\SysWOW64\hgjp.exe uqgm.exe File created C:\Windows\SysWOW64\favn.exe scak.exe File created C:\Windows\SysWOW64\okrn.exe cuok.exe File opened for modification C:\Windows\SysWOW64\nhns.exe bisq.exe File created C:\Windows\SysWOW64\fkqo.exe fshw.exe File created C:\Windows\SysWOW64\snle.exe jknu.exe File opened for modification C:\Windows\SysWOW64\iacq.exe vcho.exe File created C:\Windows\SysWOW64\ykns.exe novz.exe File created C:\Windows\SysWOW64\jelp.exe wnim.exe File opened for modification C:\Windows\SysWOW64\plfx.exe cvku.exe File opened for modification C:\Windows\SysWOW64\vels.exe igip.exe File created C:\Windows\SysWOW64\xeuv.exe ncfl.exe File created C:\Windows\SysWOW64\ebkw.exe rdpu.exe File opened for modification C:\Windows\SysWOW64\djkj.exe qshg.exe File created C:\Windows\SysWOW64\jftb.exe whyg.exe File opened for modification C:\Windows\SysWOW64\pjag.exe fvzr.exe File opened for modification C:\Windows\SysWOW64\bisq.exe ospn.exe File opened for modification C:\Windows\SysWOW64\duiq.exe ustg.exe File opened for modification C:\Windows\SysWOW64\hbww.exe fkqo.exe File opened for modification C:\Windows\SysWOW64\bgfx.exe ohku.exe File opened for modification C:\Windows\SysWOW64\jknu.exe wusr.exe File opened for modification C:\Windows\SysWOW64\udoy.exe hmtv.exe File opened for modification C:\Windows\SysWOW64\dgdi.exe thrk.exe File opened for modification C:\Windows\SysWOW64\jqrp.exe cftk.exe File created C:\Windows\SysWOW64\qeyk.exe dgdi.exe File opened for modification C:\Windows\SysWOW64\hrlk.exe xdlm.exe File opened for modification C:\Windows\SysWOW64\uzoa.exe haty.exe File opened for modification C:\Windows\SysWOW64\acdg.exe nmad.exe File opened for modification C:\Windows\SysWOW64\coto.exe pyym.exe File created C:\Windows\SysWOW64\qxhv.exe dgms.exe File created C:\Windows\SysWOW64\omph.exe dnkj.exe File created C:\Windows\SysWOW64\jzqd.exe winb.exe File created C:\Windows\SysWOW64\winb.exe jkty.exe File created C:\Windows\SysWOW64\yzgu.exe plfx.exe File opened for modification C:\Windows\SysWOW64\ucfr.exe hlcp.exe File created C:\Windows\SysWOW64\acdg.exe nmad.exe File opened for modification C:\Windows\SysWOW64\hqgz.exe zphz.exe File created C:\Windows\SysWOW64\gqwi.exe wrsk.exe File created C:\Windows\SysWOW64\anfb.exe nxly.exe File created C:\Windows\SysWOW64\wlmj.exe jmrg.exe File opened for modification C:\Windows\SysWOW64\igip.exe vpon.exe File created C:\Windows\SysWOW64\zcvg.exe krqa.exe File opened for modification C:\Windows\SysWOW64\wrsk.exe mdsn.exe File created C:\Windows\SysWOW64\kikb.exe axvy.exe File created C:\Windows\SysWOW64\cftk.exe phqh.exe File opened for modification C:\Windows\SysWOW64\wlmj.exe jmrg.exe File opened for modification C:\Windows\SysWOW64\uxhz.exe pcxj.exe File created C:\Windows\SysWOW64\axiv.exe nhns.exe File created C:\Windows\SysWOW64\fgei.exe sqkf.exe File created C:\Windows\SysWOW64\czvj.exe pjag.exe File opened for modification C:\Windows\SysWOW64\okrn.exe cuok.exe File opened for modification C:\Windows\SysWOW64\ycfv.exe leks.exe File created C:\Windows\SysWOW64\hmtv.exe uoys.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tets.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ylsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qbjz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltax.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language optr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kyct.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wrsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fgkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language coto.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axiv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language haty.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uzoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bzge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vmpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uqgm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aulr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xclv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qjzk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language twzp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language izcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sqkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gmur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mzio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efpy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jmrg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kpvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cpmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zazu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qmea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language knzz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qxhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uxes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bayf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ukyv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language viim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rval.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ytoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qeyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxly.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gzmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ivgn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rywq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gqwi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2736 1728 JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe 30 PID 1728 wrote to memory of 2736 1728 JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe 30 PID 1728 wrote to memory of 2736 1728 JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe 30 PID 1728 wrote to memory of 2736 1728 JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe 30 PID 2736 wrote to memory of 276 2736 dbel.exe 31 PID 2736 wrote to memory of 276 2736 dbel.exe 31 PID 2736 wrote to memory of 276 2736 dbel.exe 31 PID 2736 wrote to memory of 276 2736 dbel.exe 31 PID 276 wrote to memory of 2088 276 uidi.exe 32 PID 276 wrote to memory of 2088 276 uidi.exe 32 PID 276 wrote to memory of 2088 276 uidi.exe 32 PID 276 wrote to memory of 2088 276 uidi.exe 32 PID 2088 wrote to memory of 2136 2088 krqa.exe 33 PID 2088 wrote to memory of 2136 2088 krqa.exe 33 PID 2088 wrote to memory of 2136 2088 krqa.exe 33 PID 2088 wrote to memory of 2136 2088 krqa.exe 33 PID 2136 wrote to memory of 2980 2136 zcvg.exe 34 PID 2136 wrote to memory of 2980 2136 zcvg.exe 34 PID 2136 wrote to memory of 2980 2136 zcvg.exe 34 PID 2136 wrote to memory of 2980 2136 zcvg.exe 34 PID 2980 wrote to memory of 376 2980 fgvd.exe 35 PID 2980 wrote to memory of 376 2980 fgvd.exe 35 PID 2980 wrote to memory of 376 2980 fgvd.exe 35 PID 2980 wrote to memory of 376 2980 fgvd.exe 35 PID 376 wrote to memory of 2384 376 fshw.exe 36 PID 376 wrote to memory of 2384 376 fshw.exe 36 PID 376 wrote to memory of 2384 376 fshw.exe 36 PID 376 wrote to memory of 2384 376 fshw.exe 36 PID 2384 wrote to memory of 2728 2384 fkqo.exe 37 PID 2384 wrote to memory of 2728 2384 fkqo.exe 37 PID 2384 wrote to memory of 2728 2384 fkqo.exe 37 PID 2384 wrote to memory of 2728 2384 fkqo.exe 37 PID 2728 wrote to memory of 2700 2728 hbww.exe 38 PID 2728 wrote to memory of 2700 2728 hbww.exe 38 PID 2728 wrote to memory of 2700 2728 hbww.exe 38 PID 2728 wrote to memory of 2700 2728 hbww.exe 38 PID 2700 wrote to memory of 632 2700 wzdw.exe 39 PID 2700 wrote to memory of 632 2700 wzdw.exe 39 PID 2700 wrote to memory of 632 2700 wzdw.exe 39 PID 2700 wrote to memory of 632 2700 wzdw.exe 39 PID 632 wrote to memory of 440 632 blxe.exe 40 PID 632 wrote to memory of 440 632 blxe.exe 40 PID 632 wrote to memory of 440 632 blxe.exe 40 PID 632 wrote to memory of 440 632 blxe.exe 40 PID 440 wrote to memory of 2584 440 dzzg.exe 41 PID 440 wrote to memory of 2584 440 dzzg.exe 41 PID 440 wrote to memory of 2584 440 dzzg.exe 41 PID 440 wrote to memory of 2584 440 dzzg.exe 41 PID 2584 wrote to memory of 1408 2584 doxm.exe 42 PID 2584 wrote to memory of 1408 2584 doxm.exe 42 PID 2584 wrote to memory of 1408 2584 doxm.exe 42 PID 2584 wrote to memory of 1408 2584 doxm.exe 42 PID 1408 wrote to memory of 2240 1408 shug.exe 43 PID 1408 wrote to memory of 2240 1408 shug.exe 43 PID 1408 wrote to memory of 2240 1408 shug.exe 43 PID 1408 wrote to memory of 2240 1408 shug.exe 43 PID 2240 wrote to memory of 708 2240 zphz.exe 44 PID 2240 wrote to memory of 708 2240 zphz.exe 44 PID 2240 wrote to memory of 708 2240 zphz.exe 44 PID 2240 wrote to memory of 708 2240 zphz.exe 44 PID 708 wrote to memory of 1692 708 hqgz.exe 45 PID 708 wrote to memory of 1692 708 hqgz.exe 45 PID 708 wrote to memory of 1692 708 hqgz.exe 45 PID 708 wrote to memory of 1692 708 hqgz.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\dbel.exeC:\Windows\system32\dbel.exe 636 "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_007f1600b0a0777c591f415db8ec29a3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\uidi.exeC:\Windows\system32\uidi.exe 612 "C:\Windows\SysWOW64\dbel.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\krqa.exeC:\Windows\system32\krqa.exe 616 "C:\Windows\SysWOW64\uidi.exe"4⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\zcvg.exeC:\Windows\system32\zcvg.exe 620 "C:\Windows\SysWOW64\krqa.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\fgvd.exeC:\Windows\system32\fgvd.exe 640 "C:\Windows\SysWOW64\zcvg.exe"6⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\fshw.exeC:\Windows\system32\fshw.exe 660 "C:\Windows\SysWOW64\fgvd.exe"7⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\fkqo.exeC:\Windows\system32\fkqo.exe 628 "C:\Windows\SysWOW64\fshw.exe"8⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\hbww.exeC:\Windows\system32\hbww.exe 632 "C:\Windows\SysWOW64\fkqo.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\wzdw.exeC:\Windows\system32\wzdw.exe 624 "C:\Windows\SysWOW64\hbww.exe"10⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\blxe.exeC:\Windows\system32\blxe.exe 644 "C:\Windows\SysWOW64\wzdw.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\dzzg.exeC:\Windows\system32\dzzg.exe 652 "C:\Windows\SysWOW64\blxe.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\doxm.exeC:\Windows\system32\doxm.exe 668 "C:\Windows\SysWOW64\dzzg.exe"13⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\shug.exeC:\Windows\system32\shug.exe 736 "C:\Windows\SysWOW64\doxm.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\zphz.exeC:\Windows\system32\zphz.exe 740 "C:\Windows\SysWOW64\shug.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\hqgz.exeC:\Windows\system32\hqgz.exe 656 "C:\Windows\SysWOW64\zphz.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\mjwz.exeC:\Windows\system32\mjwz.exe 708 "C:\Windows\SysWOW64\hqgz.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Windows\SysWOW64\myme.exeC:\Windows\system32\myme.exe 664 "C:\Windows\SysWOW64\mjwz.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Windows\SysWOW64\dnkj.exeC:\Windows\system32\dnkj.exe 756 "C:\Windows\SysWOW64\myme.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Windows\SysWOW64\omph.exeC:\Windows\system32\omph.exe 764 "C:\Windows\SysWOW64\dnkj.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Windows\SysWOW64\bzge.exeC:\Windows\system32\bzge.exe 768 "C:\Windows\SysWOW64\omph.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Windows\SysWOW64\ljvh.exeC:\Windows\system32\ljvh.exe 772 "C:\Windows\SysWOW64\bzge.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Windows\SysWOW64\viim.exeC:\Windows\system32\viim.exe 792 "C:\Windows\SysWOW64\ljvh.exe"23⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Windows\SysWOW64\izcp.exeC:\Windows\system32\izcp.exe 776 "C:\Windows\SysWOW64\viim.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:988 -
C:\Windows\SysWOW64\phqh.exeC:\Windows\system32\phqh.exe 780 "C:\Windows\SysWOW64\izcp.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\cftk.exeC:\Windows\system32\cftk.exe 760 "C:\Windows\SysWOW64\phqh.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2268 -
C:\Windows\SysWOW64\jqrp.exeC:\Windows\system32\jqrp.exe 788 "C:\Windows\SysWOW64\cftk.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Windows\SysWOW64\wpmr.exeC:\Windows\system32\wpmr.exe 796 "C:\Windows\SysWOW64\jqrp.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Windows\SysWOW64\goyp.exeC:\Windows\system32\goyp.exe 800 "C:\Windows\SysWOW64\wpmr.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Windows\SysWOW64\tets.exeC:\Windows\system32\tets.exe 784 "C:\Windows\SysWOW64\goyp.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\dlfp.exeC:\Windows\system32\dlfp.exe 812 "C:\Windows\SysWOW64\tets.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Windows\SysWOW64\novz.exeC:\Windows\system32\novz.exe 808 "C:\Windows\SysWOW64\dlfp.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2836 -
C:\Windows\SysWOW64\ykns.exeC:\Windows\system32\ykns.exe 820 "C:\Windows\SysWOW64\novz.exe"33⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\kaqn.exeC:\Windows\system32\kaqn.exe 816 "C:\Windows\SysWOW64\ykns.exe"34⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\stpa.exeC:\Windows\system32\stpa.exe 832 "C:\Windows\SysWOW64\kaqn.exe"35⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:3048 -
C:\Windows\SysWOW64\fkkc.exeC:\Windows\system32\fkkc.exe 824 "C:\Windows\SysWOW64\stpa.exe"36⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\pjwa.exeC:\Windows\system32\pjwa.exe 828 "C:\Windows\SysWOW64\fkkc.exe"37⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Windows\SysWOW64\chrc.exeC:\Windows\system32\chrc.exe 836 "C:\Windows\SysWOW64\pjwa.exe"38⤵
- Executes dropped EXE
PID:2764 -
C:\Windows\SysWOW64\mdsn.exeC:\Windows\system32\mdsn.exe 840 "C:\Windows\SysWOW64\chrc.exe"39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2068 -
C:\Windows\SysWOW64\wrsk.exeC:\Windows\system32\wrsk.exe 804 "C:\Windows\SysWOW64\mdsn.exe"40⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Windows\SysWOW64\gqwi.exeC:\Windows\system32\gqwi.exe 848 "C:\Windows\SysWOW64\wrsk.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Windows\SysWOW64\thrk.exeC:\Windows\system32\thrk.exe 844 "C:\Windows\SysWOW64\gqwi.exe"42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1924 -
C:\Windows\SysWOW64\dgdi.exeC:\Windows\system32\dgdi.exe 856 "C:\Windows\SysWOW64\thrk.exe"43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\qeyk.exeC:\Windows\system32\qeyk.exe 860 "C:\Windows\SysWOW64\dgdi.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Windows\SysWOW64\aazv.exeC:\Windows\system32\aazv.exe 852 "C:\Windows\SysWOW64\qeyk.exe"45⤵PID:2788
-
C:\Windows\SysWOW64\ncfl.exeC:\Windows\system32\ncfl.exe 864 "C:\Windows\SysWOW64\aazv.exe"46⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in System32 directory
PID:2100 -
C:\Windows\SysWOW64\xeuv.exeC:\Windows\system32\xeuv.exe 872 "C:\Windows\SysWOW64\ncfl.exe"47⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\jgal.exeC:\Windows\system32\jgal.exe 876 "C:\Windows\SysWOW64\xeuv.exe"48⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:2036 -
C:\Windows\SysWOW64\wxvf.exeC:\Windows\system32\wxvf.exe 884 "C:\Windows\SysWOW64\jgal.exe"49⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:2360 -
C:\Windows\SysWOW64\jnyi.exeC:\Windows\system32\jnyi.exe 880 "C:\Windows\SysWOW64\wxvf.exe"50⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:568 -
C:\Windows\SysWOW64\ujza.exeC:\Windows\system32\ujza.exe 900 "C:\Windows\SysWOW64\jnyi.exe"51⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\vxsq.exeC:\Windows\system32\vxsq.exe 868 "C:\Windows\SysWOW64\ujza.exe"52⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:1544 -
C:\Windows\SysWOW64\ikjn.exeC:\Windows\system32\ikjn.exe 896 "C:\Windows\SysWOW64\vxsq.exe"53⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:2876 -
C:\Windows\SysWOW64\vmpv.exeC:\Windows\system32\vmpv.exe 888 "C:\Windows\SysWOW64\ikjn.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\fltt.exeC:\Windows\system32\fltt.exe 908 "C:\Windows\SysWOW64\vmpv.exe"55⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in System32 directory
PID:2660 -
C:\Windows\SysWOW64\snhi.exeC:\Windows\system32\snhi.exe 904 "C:\Windows\SysWOW64\fltt.exe"56⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\cjab.exeC:\Windows\system32\cjab.exe 892 "C:\Windows\SysWOW64\snhi.exe"57⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\SysWOW64\mlqd.exeC:\Windows\system32\mlqd.exe 928 "C:\Windows\SysWOW64\cjab.exe"58⤵
- Executes dropped EXE
PID:2636 -
C:\Windows\SysWOW64\wsci.exeC:\Windows\system32\wsci.exe 920 "C:\Windows\SysWOW64\mlqd.exe"59⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\jmiq.exeC:\Windows\system32\jmiq.exe 916 "C:\Windows\SysWOW64\wsci.exe"60⤵
- Executes dropped EXE
PID:1576 -
C:\Windows\SysWOW64\tumo.exeC:\Windows\system32\tumo.exe 932 "C:\Windows\SysWOW64\jmiq.exe"61⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\ghdl.exeC:\Windows\system32\ghdl.exe 912 "C:\Windows\SysWOW64\tumo.exe"62⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\SysWOW64\qgij.exeC:\Windows\system32\qgij.exe 940 "C:\Windows\SysWOW64\ghdl.exe"63⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\dioq.exeC:\Windows\system32\dioq.exe 924 "C:\Windows\SysWOW64\qgij.exe"64⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:2444 -
C:\Windows\SysWOW64\nklb.exeC:\Windows\system32\nklb.exe 948 "C:\Windows\SysWOW64\dioq.exe"65⤵
- Executes dropped EXE
PID:1828 -
C:\Windows\SysWOW64\axvy.exeC:\Windows\system32\axvy.exe 936 "C:\Windows\SysWOW64\nklb.exe"66⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\kikb.exeC:\Windows\system32\kikb.exe 964 "C:\Windows\SysWOW64\axvy.exe"67⤵PID:2212
-
C:\Windows\SysWOW64\cpmo.exeC:\Windows\system32\cpmo.exe 944 "C:\Windows\SysWOW64\kikb.exe"68⤵
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\mvnl.exeC:\Windows\system32\mvnl.exe 960 "C:\Windows\SysWOW64\cpmo.exe"69⤵
- Identifies Wine through registry keys
PID:2696 -
C:\Windows\SysWOW64\zuqo.exeC:\Windows\system32\zuqo.exe 956 "C:\Windows\SysWOW64\mvnl.exe"70⤵
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\mkkj.exeC:\Windows\system32\mkkj.exe 968 "C:\Windows\SysWOW64\zuqo.exe"71⤵PID:2676
-
C:\Windows\SysWOW64\zjfm.exeC:\Windows\system32\zjfm.exe 972 "C:\Windows\SysWOW64\mkkj.exe"72⤵PID:912
-
C:\Windows\SysWOW64\mzio.exeC:\Windows\system32\mzio.exe 976 "C:\Windows\SysWOW64\zjfm.exe"73⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Windows\SysWOW64\vnjm.exeC:\Windows\system32\vnjm.exe 952 "C:\Windows\SysWOW64\mzio.exe"74⤵
- Identifies Wine through registry keys
PID:2608 -
C:\Windows\SysWOW64\iedo.exeC:\Windows\system32\iedo.exe 988 "C:\Windows\SysWOW64\vnjm.exe"75⤵
- Identifies Wine through registry keys
PID:2112 -
C:\Windows\SysWOW64\vcyr.exeC:\Windows\system32\vcyr.exe 984 "C:\Windows\SysWOW64\iedo.exe"76⤵PID:676
-
C:\Windows\SysWOW64\ittu.exeC:\Windows\system32\ittu.exe 996 "C:\Windows\SysWOW64\vcyr.exe"77⤵PID:2328
-
C:\Windows\SysWOW64\vjww.exeC:\Windows\system32\vjww.exe 992 "C:\Windows\SysWOW64\ittu.exe"78⤵
- Identifies Wine through registry keys
PID:1956 -
C:\Windows\SysWOW64\fxwm.exeC:\Windows\system32\fxwm.exe 752 "C:\Windows\SysWOW64\vjww.exe"79⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\SysWOW64\swro.exeC:\Windows\system32\swro.exe 1004 "C:\Windows\SysWOW64\fxwm.exe"80⤵
- Identifies Wine through registry keys
PID:1424 -
C:\Windows\SysWOW64\fmmr.exeC:\Windows\system32\fmmr.exe 1016 "C:\Windows\SysWOW64\swro.exe"81⤵PID:2732
-
C:\Windows\SysWOW64\rdpu.exeC:\Windows\system32\rdpu.exe 1000 "C:\Windows\SysWOW64\fmmr.exe"82⤵
- Drops file in System32 directory
PID:576 -
C:\Windows\SysWOW64\ebkw.exeC:\Windows\system32\ebkw.exe 1032 "C:\Windows\SysWOW64\rdpu.exe"83⤵PID:2200
-
C:\Windows\SysWOW64\ohku.exeC:\Windows\system32\ohku.exe 1012 "C:\Windows\SysWOW64\ebkw.exe"84⤵
- Drops file in System32 directory
PID:1032 -
C:\Windows\SysWOW64\bgfx.exeC:\Windows\system32\bgfx.exe 1020 "C:\Windows\SysWOW64\ohku.exe"85⤵PID:2060
-
C:\Windows\SysWOW64\owiz.exeC:\Windows\system32\owiz.exe 1028 "C:\Windows\SysWOW64\bgfx.exe"86⤵PID:1072
-
C:\Windows\SysWOW64\yhxc.exeC:\Windows\system32\yhxc.exe 1036 "C:\Windows\SysWOW64\owiz.exe"87⤵PID:1816
-
C:\Windows\SysWOW64\lyse.exeC:\Windows\system32\lyse.exe 1040 "C:\Windows\SysWOW64\yhxc.exe"88⤵
- Drops file in System32 directory
PID:2616 -
C:\Windows\SysWOW64\ywnh.exeC:\Windows\system32\ywnh.exe 1056 "C:\Windows\SysWOW64\lyse.exe"89⤵
- Drops file in System32 directory
PID:2180 -
C:\Windows\SysWOW64\knqk.exeC:\Windows\system32\knqk.exe 1044 "C:\Windows\SysWOW64\ywnh.exe"90⤵PID:2336
-
C:\Windows\SysWOW64\xdlm.exeC:\Windows\system32\xdlm.exe 1048 "C:\Windows\SysWOW64\knqk.exe"91⤵
- Identifies Wine through registry keys
- Drops file in System32 directory
PID:2672 -
C:\Windows\SysWOW64\hrlk.exeC:\Windows\system32\hrlk.exe 1052 "C:\Windows\SysWOW64\xdlm.exe"92⤵PID:2368
-
C:\Windows\SysWOW64\uqgm.exeC:\Windows\system32\uqgm.exe 1060 "C:\Windows\SysWOW64\hrlk.exe"93⤵
- Identifies Wine through registry keys
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Windows\SysWOW64\hgjp.exeC:\Windows\system32\hgjp.exe 1064 "C:\Windows\SysWOW64\uqgm.exe"94⤵
- Identifies Wine through registry keys
PID:2816 -
C:\Windows\SysWOW64\uxes.exeC:\Windows\system32\uxes.exe 1072 "C:\Windows\SysWOW64\hgjp.exe"95⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Windows\SysWOW64\hvyv.exeC:\Windows\system32\hvyv.exe 1076 "C:\Windows\SysWOW64\uxes.exe"96⤵PID:672
-
C:\Windows\SysWOW64\qjzk.exeC:\Windows\system32\qjzk.exe 1092 "C:\Windows\SysWOW64\hvyv.exe"97⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\daun.exeC:\Windows\system32\daun.exe 1068 "C:\Windows\SysWOW64\qjzk.exe"98⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Windows\SysWOW64\qqxp.exeC:\Windows\system32\qqxp.exe 1080 "C:\Windows\SysWOW64\daun.exe"99⤵PID:1684
-
C:\Windows\SysWOW64\vprs.exeC:\Windows\system32\vprs.exe 1084 "C:\Windows\SysWOW64\qqxp.exe"100⤵PID:1148
-
C:\Windows\SysWOW64\frhc.exeC:\Windows\system32\frhc.exe 1096 "C:\Windows\SysWOW64\vprs.exe"101⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\SysWOW64\sqkf.exeC:\Windows\system32\sqkf.exe 1088 "C:\Windows\SysWOW64\frhc.exe"102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\SysWOW64\fgei.exeC:\Windows\system32\fgei.exe 1104 "C:\Windows\SysWOW64\sqkf.exe"103⤵PID:2568
-
C:\Windows\SysWOW64\sfzk.exeC:\Windows\system32\sfzk.exe 1100 "C:\Windows\SysWOW64\fgei.exe"104⤵PID:2920
-
C:\Windows\SysWOW64\blaa.exeC:\Windows\system32\blaa.exe 1108 "C:\Windows\SysWOW64\sfzk.exe"105⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Windows\SysWOW64\ojvc.exeC:\Windows\system32\ojvc.exe 1112 "C:\Windows\SysWOW64\blaa.exe"106⤵
- Identifies Wine through registry keys
PID:2232 -
C:\Windows\SysWOW64\bayf.exeC:\Windows\system32\bayf.exe 1116 "C:\Windows\SysWOW64\ojvc.exe"107⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\oysi.exeC:\Windows\system32\oysi.exe 1120 "C:\Windows\SysWOW64\bayf.exe"108⤵PID:1984
-
C:\Windows\SysWOW64\ybis.exeC:\Windows\system32\ybis.exe 1128 "C:\Windows\SysWOW64\oysi.exe"109⤵PID:1364
-
C:\Windows\SysWOW64\lrlv.exeC:\Windows\system32\lrlv.exe 1124 "C:\Windows\SysWOW64\ybis.exe"110⤵
- Identifies Wine through registry keys
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\yqfy.exeC:\Windows\system32\yqfy.exe 1132 "C:\Windows\SysWOW64\lrlv.exe"111⤵PID:1204
-
C:\Windows\SysWOW64\lgaa.exeC:\Windows\system32\lgaa.exe 1136 "C:\Windows\SysWOW64\yqfy.exe"112⤵
- Identifies Wine through registry keys
PID:1292 -
C:\Windows\SysWOW64\uvbq.exeC:\Windows\system32\uvbq.exe 1144 "C:\Windows\SysWOW64\lgaa.exe"113⤵PID:2248
-
C:\Windows\SysWOW64\hlws.exeC:\Windows\system32\hlws.exe 1140 "C:\Windows\SysWOW64\uvbq.exe"114⤵PID:2072
-
C:\Windows\SysWOW64\ukyv.exeC:\Windows\system32\ukyv.exe 1152 "C:\Windows\SysWOW64\hlws.exe"115⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\SysWOW64\haty.exeC:\Windows\system32\haty.exe 1008 "C:\Windows\SysWOW64\ukyv.exe"116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\uzoa.exeC:\Windows\system32\uzoa.exe 1160 "C:\Windows\SysWOW64\haty.exe"117⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Windows\SysWOW64\efpy.exeC:\Windows\system32\efpy.exe 1156 "C:\Windows\SysWOW64\uzoa.exe"118⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\SysWOW64\rdra.exeC:\Windows\system32\rdra.exe 1164 "C:\Windows\SysWOW64\efpy.exe"119⤵PID:2552
-
C:\Windows\SysWOW64\dumd.exeC:\Windows\system32\dumd.exe 1168 "C:\Windows\SysWOW64\rdra.exe"120⤵
- Identifies Wine through registry keys
PID:2308 -
C:\Windows\SysWOW64\qshg.exeC:\Windows\system32\qshg.exe 1176 "C:\Windows\SysWOW64\dumd.exe"121⤵
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\djkj.exeC:\Windows\system32\djkj.exe 1172 "C:\Windows\SysWOW64\qshg.exe"122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-