Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 09:55
Behavioral task
behavioral1
Sample
JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe
-
Size
149KB
-
MD5
55e87d644c383ee9fa9caf50cd9b738b
-
SHA1
c6dac2322699a6bbd28fdaf4272535a49939b9d9
-
SHA256
10ef7e6d32e8398b2613989f9e5c978acb60161b1816e2630f5dd3469a9cf2e1
-
SHA512
df709e1b5281d3375f8310fe370869a4153f43a3a2041d2f46cb5c8452bbec1a4ffa9048d4dbc859831c982b5e2bb1e67878d9a30d27130611c73f3290bb1e7b
-
SSDEEP
3072:P2T7uCWOhANdpgMxsdSyg4TvtcMk8Lyzb8ckivlu5KgiCbmN:PW7uCWOh4pl2GkGMkSgb8Svlu5KgON
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 11 IoCs
resource yara_rule behavioral1/files/0x00080000000120ff-7.dat family_gh0strat behavioral1/files/0x00070000000170b5-22.dat family_gh0strat behavioral1/files/0x00070000000175c6-47.dat family_gh0strat behavioral1/files/0x0034000000018654-53.dat family_gh0strat behavioral1/files/0x0005000000019515-66.dat family_gh0strat behavioral1/files/0x000500000001957c-81.dat family_gh0strat behavioral1/files/0x000500000001961b-97.dat family_gh0strat behavioral1/files/0x0005000000019624-115.dat family_gh0strat behavioral1/files/0x0005000000019c50-167.dat family_gh0strat behavioral1/files/0x0005000000019aec-154.dat family_gh0strat behavioral1/files/0x00050000000197c1-139.dat family_gh0strat -
Gh0strat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{n9p7zeoi-yqjk-0v9d-878l-15nl8jf7e37r}\stubpath = "C:\\Windows\\System32\\inyrzjrbh.exe" inxcfnkrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{qhffspnd-15l7-vywc-w06x-k38yli9mhqp0} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{odmimtba-wknl-buvw-qxar-huciwhruhwx3} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{omvifufs-aaud-obew-wjkv-dbinpycnbwwl} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{nfkkfoly-yjzt-jhvm-flmz-pcsehuvxxizi} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{cutcfncm-flis-uecl-udcu-fevsppubvfwe} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{s40ljf7u-330l-e93o-1g7o-5oprbynfa61v}\stubpath = "C:\\Windows\\System32\\inmxiifwj.exe" inpriaela.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ymibcecl-hhbi-ecpb-wdeh-gjmqmkytgdsd}\ = "ϵͳÉèÖÃ" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08t240b2-dk8r-9rn1-23a6-050gpo7n2570} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{hdythdpk-siqh-mcmi-krak-ibxwyurlmgxc} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{eowdifku-hinc-wlvb-ainh-dfnmjjqhpbez} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{dcsjlxgz-czdz-hpwj-tvcz-oltsnzbyomqf}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{w0aex1at-u0zt-n48h-lr5j-qz9vku8nunwg}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{tmopndbq-uu7k-w2rh-nwtz-nf412k95diy3}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{siro55qx-4552-bw66-e6jy-rpf1ze3hubr3}\ = "ϵͳÉèÖÃ" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{unkxflzk-uxkz-gpyn-jvda-ffwdegsmnxff} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{jc16v6q6-biu1-zg90-pmxq-s7c8yk6nws28} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{hrynvfrk-pach-qvtj-lgek-lhfojglylucp} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{w8x3j369-ewtc-z5sq-8r03-4x7d895juvjz}\stubpath = "C:\\Windows\\System32\\inspxvnqi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ddml1ix8-tda4-4rxg-9eae-oj6vxgrgmu6x}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{kdembmtq-pnti-zzbe-tqit-dyujdmrbntgg}\ = "ϵͳÉèÖÃ" inmkoozmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{jpicgdtr-urrj-yyml-idql-ldcweozvebcz}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{kzznmaje-mwme-xafp-fcdi-zdtrgsqhyodb}\stubpath = "C:\\Windows\\System32\\indvsiska.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{tqkbnjeo-uspp-hrrn-diez-ieqlbtjrixnd}\stubpath = "C:\\Windows\\System32\\inbpymaci.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ykzfucoz-vzup-uxpv-yrol-ohabpdjojqnk}\ = "ϵͳÉèÖÃ" inyenhigo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{tmbnhddr-ivbd-exub-vncu-foftymeasueq}\stubpath = "C:\\Windows\\System32\\inwdbwaud.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{m4i0j70j-xqy7-fp6s-qgoq-jgk94qenz5np}\stubpath = "C:\\Windows\\System32\\indzwfuxp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{s2q9okcx-tdqe-jcwu-a4gi-z0e3iwpwalla}\ = "ϵͳÉèÖÃ" inbnjcuis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{wcwpqbrf-mple-uyfc-kdeg-nfjjdkwgerds}\stubpath = "C:\\Windows\\System32\\inrdzuwql.exe" indltdckl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{mitstgrj-grqj-znwt-nbts-qlvwyfvpakka}\ = "ϵͳÉèÖÃ" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{pjingspm-kflv-vmcu-koev-bpmaitqkbnje} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{palnibj4-4gyk-2tsf-2vu6-h0lmbky928zp}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{pefzxhhn-kgil-qfrg-kpuw-auisffracasa}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zqietqde-eux6-cbmk-zueq-oy5edg1umwj4}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{apnreucx-a8zu-5ctg-103c-rl507t9icb60}\ = "ϵͳÉèÖÃ" inrdysgih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{gzho8pch-bbkk-obqs-zaqd-vamjh6iwofgz} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ynwjskns-bcxh-2tlh-bawt-ghxfrfepnoxh}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{t417lo7x-0vn4-bbol-wc1h-vrusvs2x13g4}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{fwinnysz-modk-jtkz-obzu-yzmxpmmepetz}\stubpath = "C:\\Windows\\System32\\ingfhwoyd.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zhkqiogf-wweq-qmbc-amew-funrowvqkcea} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{fzjvupeu-jqkg-hzuw-ovfr-hltdhsthcffh}\ = "ϵͳÉèÖÃ" intndtuwg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{lqxvhdzd-jhbr-itwm-jscd-vphepqlsozsr}\ = "ϵͳÉèÖÃ" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{bwkuahce-uczl-apnl-dvgm-qtnwghzbztlc} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{uacdwtaj-mbtk-nesx-ddtd-jojpicgdtrcu} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{dre46x85-2ps2-z4zr-v0g1-l7zvywcbw06x} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{hclqlj14-147o-1jfl-uak8-m147t20s4kag}\ = "ϵͳÉèÖÃ" inkbytnkt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{xtmnkocw-mibr-vcix-lhab-bkcggahtdboa}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ozchfmrt-brfy-ccof-kpwu-cycvigaqbzsv}\stubpath = "C:\\Windows\\System32\\insbnbenc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{xagmoyva-uobs-gujs-o3zg-5oy4056phzds}\stubpath = "C:\\Windows\\System32\\inxaimtnc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{kjohtqnz-gmww-dvlp-wzcq-bjurcokfpuvt}\stubpath = "C:\\Windows\\System32\\indvycefq.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0n64ol24-s3s1-11og-3vj6-m12qn92xwnqh} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{bjsdwwiz-khsv-ekru-jzzc-htpejjskooep} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46p6sn5u-g036-btqv-2p42-o9t021u4a56i}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{vynclh2z-jmks-tuvw-wjqj-tbhvgqtgvw2l}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{824ho354-3mj1-7g8f-52wu-v4798m39p9nd}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zf04k6yu-vb2a-5w6j-7xkh-8lgpo761jlw4}\stubpath = "C:\\Windows\\System32\\ingeerhom.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{el19vqje-zxtf-ln59-l30t-x5l25d0m6efm}\stubpath = "C:\\Windows\\System32\\inenfezbl.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{eoxapfkw-zptl-kfbk-nfla-hebsbfossevr} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{eufwhxjs-hqmq-feao-paxf-zusevoalygmp}\ = "ϵͳÉèÖÃ" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zl82w0ae-1aty-0ztv-48hf-r5j0qz9vku8n} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{frozstu9-4m8p-u42u-4opb-7xpkrs11w4g5}\ = "ϵͳÉèÖÃ" inwicolxs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4402c6y4-0sl0-9q2e-lz84-a4z378ss93z3}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zvdezcdn-tixt-mits-grjg-rqjjznwtznbt}\stubpath = "C:\\Windows\\System32\\inqsrmwta.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zbeiyfoz-gyjj-qicy-oeou-hblywzdwozaq}\stubpath = "C:\\Windows\\System32\\indhbhvlh.exe" Process not Found -
Executes dropped EXE 64 IoCs
pid Process 2804 inbfyviuk.exe 3024 injyqkarh.exe 2736 innqsrkjz.exe 2648 inpsutmlb.exe 2564 insvxwpco.exe 2516 insezthji.exe 1976 inyufnzuj.exe 2212 inixpjqgj.exe 2852 inyjbrycn.exe 1848 inmprqjiy.exe 1380 inpleqlxa.exe 568 inmtnbdcu.exe 2052 insohtodl.exe 2116 inogwahsa.exe 2576 inuqbjvqf.exe 2364 inugvjlkd.exe 2016 incvyzsfr.exe 1596 ingvnhoze.exe 840 inwixlnmf.exe 1760 inxiaqxbm.exe 2204 inykznpoh.exe 952 indhxkwmb.exe 1232 inlsmacbt.exe 564 inqmfrmyb.exe 2660 innfvgrkz.exe 2112 inoavpdfe.exe 1744 invuwaxma.exe 2792 inaphxbit.exe 1580 ineybxzdp.exe 3028 invrckwrg.exe 2904 inbaqtkjr.exe 2896 inbuxzyre.exe 2776 infumgnyd.exe 2816 indwztgsi.exe 2676 inwhpwale.exe 1776 inxjymong.exe 1844 ingvetxyk.exe 2564 inkzrlbas.exe 2524 inigtklnv.exe 2320 inknedlyl.exe 2992 inortslka.exe 3008 inljyapnv.exe 2696 inpbwqegf.exe 2488 innlypqcs.exe 1752 inrdysgih.exe 748 inwsdlxsh.exe 2256 inetlfmxc.exe 1848 inhegsgsd.exe 2412 inzvgovkd.exe 2160 ineuxonvv.exe 2116 inkbaivic.exe 1156 ingwzqpxx.exe 1972 inldtepix.exe 976 injmdckxk.exe 1856 injhulmow.exe 1536 inixomukg.exe 1760 inwmpgfnn.exe 2204 intpaiupe.exe 2400 inbmkzbqa.exe 1940 indpalewk.exe 3020 inomzqrdt.exe 876 inrlmbbts.exe 2708 inqgdzfrf.exe 2756 ingerepgv.exe -
Loads dropped DLL 64 IoCs
pid Process 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 2804 inbfyviuk.exe 2804 inbfyviuk.exe 2804 inbfyviuk.exe 2804 inbfyviuk.exe 3024 injyqkarh.exe 3024 injyqkarh.exe 3024 injyqkarh.exe 3024 injyqkarh.exe 2736 innqsrkjz.exe 2736 innqsrkjz.exe 2736 innqsrkjz.exe 2736 innqsrkjz.exe 2648 inpsutmlb.exe 2648 inpsutmlb.exe 2648 inpsutmlb.exe 2648 inpsutmlb.exe 2564 insvxwpco.exe 2564 insvxwpco.exe 2564 insvxwpco.exe 2564 insvxwpco.exe 2516 insezthji.exe 2516 insezthji.exe 2516 insezthji.exe 2516 insezthji.exe 1976 inyufnzuj.exe 1976 inyufnzuj.exe 1976 inyufnzuj.exe 1976 inyufnzuj.exe 2212 inixpjqgj.exe 2212 inixpjqgj.exe 2212 inixpjqgj.exe 2212 inixpjqgj.exe 2852 inyjbrycn.exe 2852 inyjbrycn.exe 2852 inyjbrycn.exe 2852 inyjbrycn.exe 1848 inmprqjiy.exe 1848 inmprqjiy.exe 1848 inmprqjiy.exe 1848 inmprqjiy.exe 1380 inpleqlxa.exe 1380 inpleqlxa.exe 1380 inpleqlxa.exe 1380 inpleqlxa.exe 568 inmtnbdcu.exe 568 inmtnbdcu.exe 568 inmtnbdcu.exe 568 inmtnbdcu.exe 2052 insohtodl.exe 2052 insohtodl.exe 2052 insohtodl.exe 2052 insohtodl.exe 2116 inogwahsa.exe 2116 inogwahsa.exe 2116 inogwahsa.exe 2116 inogwahsa.exe 2576 inuqbjvqf.exe 2576 inuqbjvqf.exe 2576 inuqbjvqf.exe 2576 inuqbjvqf.exe 2364 inugvjlkd.exe 2364 inugvjlkd.exe 2364 inugvjlkd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inojudayu.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inbpbcncz.exe Process not Found File created C:\Windows\SysWOW64\inhdhkncx.exe Process not Found File created C:\Windows\SysWOW64\inhswlgxa.exe Process not Found File opened for modification C:\Windows\SysWOW64\inzihhdlz.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inbttjbao.exe Process not Found File created C:\Windows\SysWOW64\inyherndc.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inwxsplcy.exe Process not Found File created C:\Windows\SysWOW64\inhpsyqja.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inzpuasvh.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\ineyyaxuz.exe_lang.ini inngbnczn.exe File created C:\Windows\SysWOW64\inagshjtq.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\ingdzllyx.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inzhlhmkb.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inbmmjnwc.exe Process not Found File created C:\Windows\SysWOW64\insukhhrr.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inmwumzaa.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\indbeeels.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inpcofqsw.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inomvcziu.exe_lang.ini inzlydrpm.exe File opened for modification C:\Windows\SysWOW64\inkfpgznc.exe_lang.ini inskhcuqg.exe File created C:\Windows\SysWOW64\inqbcmcsv.exe_lang.ini inpzplgqv.exe File created C:\Windows\SysWOW64\inmfhnkkt.exe Process not Found File opened for modification C:\Windows\SysWOW64\inefycgno.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inbwrkfuf.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inhnirqzq.exe Process not Found File created C:\Windows\SysWOW64\inbncapqk.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inpdhdshz.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inndiulal.exe inokiqcye.exe File created C:\Windows\SysWOW64\inuytxoyr.exe inmsthrks.exe File created C:\Windows\SysWOW64\inpyvrorf.exe Process not Found File created C:\Windows\SysWOW64\inasgqvzt.exe_lang.ini invbdruwx.exe File opened for modification C:\Windows\SysWOW64\inrftczbo.exe_lang.ini insanriau.exe File created C:\Windows\SysWOW64\inonispsv.exe Process not Found File created C:\Windows\SysWOW64\incmdantm.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inxwapbmm.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inrfpuysy.exe_lang.ini inewrcnnk.exe File created C:\Windows\SysWOW64\indswborw.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inovthjdm.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\injulkmbt.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inbzybeyh.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inwsdlxsh.exe inrdysgih.exe File created C:\Windows\SysWOW64\intyrdyql.exe_lang.ini inconjbpa.exe File created C:\Windows\SysWOW64\infjwakdf.exe intujfhfg.exe File created C:\Windows\SysWOW64\inrzweovz.exe inwojflbg.exe File created C:\Windows\SysWOW64\infioqdgx.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inlhcvydw.exe Process not Found File created C:\Windows\SysWOW64\inkchtofh.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inkopdoou.exe Process not Found File created C:\Windows\SysWOW64\inpiextzn.exe Process not Found File opened for modification C:\Windows\SysWOW64\inpptagvx.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inwgspyzl.exe Process not Found File created C:\Windows\SysWOW64\inolhpjke.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inlhwqxvr.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inbaqbdfi.exe infslrijv.exe File created C:\Windows\SysWOW64\inyuywnaa.exe Process not Found File created C:\Windows\SysWOW64\inkzsfysf.exe Process not Found File created C:\Windows\SysWOW64\inzlhymud.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inboeljwc.exe Process not Found File created C:\Windows\SysWOW64\invgvfzue.exe_lang.ini inytozkkh.exe File created C:\Windows\SysWOW64\inifltqxi.exe_lang.ini inlquxzdx.exe File created C:\Windows\SysWOW64\inoqvziwx.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inkbaivic.exe ineuxonvv.exe File opened for modification C:\Windows\SysWOW64\inrkqhiua.exe_lang.ini inwgusogd.exe -
resource yara_rule behavioral1/memory/2472-0-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2472-1-0x0000000000020000-0x0000000000036000-memory.dmp upx behavioral1/files/0x00080000000120ff-7.dat upx behavioral1/files/0x00070000000170b5-22.dat upx behavioral1/memory/2472-12-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2804-26-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/3024-28-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2736-48-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x00070000000175c6-47.dat upx behavioral1/memory/3024-42-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x0034000000018654-53.dat upx behavioral1/memory/2736-58-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x0005000000019515-66.dat upx behavioral1/memory/2564-72-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2648-70-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x000500000001957c-81.dat upx behavioral1/files/0x000500000001961b-97.dat upx behavioral1/memory/2516-103-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1976-111-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1976-110-0x0000000000020000-0x0000000000036000-memory.dmp upx behavioral1/memory/2564-86-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x0005000000019624-115.dat upx behavioral1/memory/2212-125-0x0000000000020000-0x0000000000036000-memory.dmp upx behavioral1/memory/1380-176-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/568-184-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x0005000000019c50-167.dat upx behavioral1/memory/1848-164-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1848-155-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x0005000000019aec-154.dat upx behavioral1/memory/2852-149-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x00050000000197c1-139.dat upx behavioral1/memory/2212-134-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1976-120-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2116-196-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2052-193-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2116-203-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2576-210-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2364-217-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2016-224-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1596-232-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/840-240-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1760-247-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2204-254-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/952-261-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1232-268-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/564-275-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2660-282-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2112-289-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1744-296-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2792-303-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1580-310-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/3028-317-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2904-325-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2896-333-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2816-342-0x0000000000020000-0x0000000000036000-memory.dmp upx behavioral1/memory/2776-341-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2816-349-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2676-356-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1776-364-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1844-366-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1844-372-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2564-382-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2524-390-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2320-398-0x0000000000400000-0x0000000000416000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaaajueu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvmlzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbskfog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innbpvwku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwonikuc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhoiekzn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqqspmro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 2804 inbfyviuk.exe 3024 injyqkarh.exe 2736 innqsrkjz.exe 2648 inpsutmlb.exe 2564 insvxwpco.exe 2516 insezthji.exe 1976 inyufnzuj.exe 2212 inixpjqgj.exe 2852 inyjbrycn.exe 1848 inmprqjiy.exe 1380 inpleqlxa.exe 568 inmtnbdcu.exe 2052 insohtodl.exe 2116 inogwahsa.exe 2576 inuqbjvqf.exe 2364 inugvjlkd.exe 2016 incvyzsfr.exe 1596 ingvnhoze.exe 840 inwixlnmf.exe 1760 inxiaqxbm.exe 2204 inykznpoh.exe 952 indhxkwmb.exe 1232 inlsmacbt.exe 564 inqmfrmyb.exe 2660 innfvgrkz.exe 2112 inoavpdfe.exe 1744 invuwaxma.exe 2792 inaphxbit.exe 1580 ineybxzdp.exe 3028 invrckwrg.exe 2904 inbaqtkjr.exe 2896 inbuxzyre.exe 2776 infumgnyd.exe 2816 indwztgsi.exe 2676 inwhpwale.exe 1776 inxjymong.exe 1844 ingvetxyk.exe 2564 inkzrlbas.exe 2524 inigtklnv.exe 2320 inknedlyl.exe 2992 inortslka.exe 3008 inljyapnv.exe 2696 inpbwqegf.exe 2488 innlypqcs.exe 1752 inrdysgih.exe 748 inwsdlxsh.exe 2256 inetlfmxc.exe 1848 inhegsgsd.exe 2412 inzvgovkd.exe 2160 ineuxonvv.exe 2116 inkbaivic.exe 1156 ingwzqpxx.exe 1972 inldtepix.exe 976 injmdckxk.exe 1856 injhulmow.exe 1536 inixomukg.exe 1760 inwmpgfnn.exe 2204 intpaiupe.exe 2400 inbmkzbqa.exe 1940 indpalewk.exe 3020 inomzqrdt.exe 876 inrlmbbts.exe 2708 inqgdzfrf.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe Token: SeDebugPrivilege 2804 inbfyviuk.exe Token: SeDebugPrivilege 3024 injyqkarh.exe Token: SeDebugPrivilege 2736 innqsrkjz.exe Token: SeDebugPrivilege 2648 inpsutmlb.exe Token: SeDebugPrivilege 2564 insvxwpco.exe Token: SeDebugPrivilege 2516 insezthji.exe Token: SeDebugPrivilege 1976 inyufnzuj.exe Token: SeDebugPrivilege 2212 inixpjqgj.exe Token: SeDebugPrivilege 2852 inyjbrycn.exe Token: SeDebugPrivilege 1848 inmprqjiy.exe Token: SeDebugPrivilege 1380 inpleqlxa.exe Token: SeDebugPrivilege 568 inmtnbdcu.exe Token: SeDebugPrivilege 2052 insohtodl.exe Token: SeDebugPrivilege 2116 inogwahsa.exe Token: SeDebugPrivilege 2576 inuqbjvqf.exe Token: SeDebugPrivilege 2364 inugvjlkd.exe Token: SeDebugPrivilege 2016 incvyzsfr.exe Token: SeDebugPrivilege 1596 ingvnhoze.exe Token: SeDebugPrivilege 840 inwixlnmf.exe Token: SeDebugPrivilege 1760 inxiaqxbm.exe Token: SeDebugPrivilege 2204 inykznpoh.exe Token: SeDebugPrivilege 952 indhxkwmb.exe Token: SeDebugPrivilege 1232 inlsmacbt.exe Token: SeDebugPrivilege 564 inqmfrmyb.exe Token: SeDebugPrivilege 2660 innfvgrkz.exe Token: SeDebugPrivilege 2112 inoavpdfe.exe Token: SeDebugPrivilege 1744 invuwaxma.exe Token: SeDebugPrivilege 2792 inaphxbit.exe Token: SeDebugPrivilege 1580 ineybxzdp.exe Token: SeDebugPrivilege 3028 invrckwrg.exe Token: SeDebugPrivilege 2904 inbaqtkjr.exe Token: SeDebugPrivilege 2896 inbuxzyre.exe Token: SeDebugPrivilege 2776 infumgnyd.exe Token: SeDebugPrivilege 2816 indwztgsi.exe Token: SeDebugPrivilege 2676 inwhpwale.exe Token: SeDebugPrivilege 1776 inxjymong.exe Token: SeDebugPrivilege 1844 ingvetxyk.exe Token: SeDebugPrivilege 2564 inkzrlbas.exe Token: SeDebugPrivilege 2524 inigtklnv.exe Token: SeDebugPrivilege 2320 inknedlyl.exe Token: SeDebugPrivilege 2992 inortslka.exe Token: SeDebugPrivilege 3008 inljyapnv.exe Token: SeDebugPrivilege 2696 inpbwqegf.exe Token: SeDebugPrivilege 2488 innlypqcs.exe Token: SeDebugPrivilege 1752 inrdysgih.exe Token: SeDebugPrivilege 748 inwsdlxsh.exe Token: SeDebugPrivilege 2256 inetlfmxc.exe Token: SeDebugPrivilege 1848 inhegsgsd.exe Token: SeDebugPrivilege 2412 inzvgovkd.exe Token: SeDebugPrivilege 2160 ineuxonvv.exe Token: SeDebugPrivilege 2116 inkbaivic.exe Token: SeDebugPrivilege 1156 ingwzqpxx.exe Token: SeDebugPrivilege 1972 inldtepix.exe Token: SeDebugPrivilege 976 injmdckxk.exe Token: SeDebugPrivilege 1856 injhulmow.exe Token: SeDebugPrivilege 1536 inixomukg.exe Token: SeDebugPrivilege 1760 inwmpgfnn.exe Token: SeDebugPrivilege 2204 intpaiupe.exe Token: SeDebugPrivilege 2400 inbmkzbqa.exe Token: SeDebugPrivilege 1940 indpalewk.exe Token: SeDebugPrivilege 3020 inomzqrdt.exe Token: SeDebugPrivilege 876 inrlmbbts.exe Token: SeDebugPrivilege 2708 inqgdzfrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2804 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 30 PID 2472 wrote to memory of 2804 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 30 PID 2472 wrote to memory of 2804 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 30 PID 2472 wrote to memory of 2804 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 30 PID 2472 wrote to memory of 2804 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 30 PID 2472 wrote to memory of 2804 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 30 PID 2472 wrote to memory of 2804 2472 JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe 30 PID 2804 wrote to memory of 3024 2804 inbfyviuk.exe 31 PID 2804 wrote to memory of 3024 2804 inbfyviuk.exe 31 PID 2804 wrote to memory of 3024 2804 inbfyviuk.exe 31 PID 2804 wrote to memory of 3024 2804 inbfyviuk.exe 31 PID 2804 wrote to memory of 3024 2804 inbfyviuk.exe 31 PID 2804 wrote to memory of 3024 2804 inbfyviuk.exe 31 PID 2804 wrote to memory of 3024 2804 inbfyviuk.exe 31 PID 3024 wrote to memory of 2736 3024 injyqkarh.exe 32 PID 3024 wrote to memory of 2736 3024 injyqkarh.exe 32 PID 3024 wrote to memory of 2736 3024 injyqkarh.exe 32 PID 3024 wrote to memory of 2736 3024 injyqkarh.exe 32 PID 3024 wrote to memory of 2736 3024 injyqkarh.exe 32 PID 3024 wrote to memory of 2736 3024 injyqkarh.exe 32 PID 3024 wrote to memory of 2736 3024 injyqkarh.exe 32 PID 2736 wrote to memory of 2648 2736 innqsrkjz.exe 33 PID 2736 wrote to memory of 2648 2736 innqsrkjz.exe 33 PID 2736 wrote to memory of 2648 2736 innqsrkjz.exe 33 PID 2736 wrote to memory of 2648 2736 innqsrkjz.exe 33 PID 2736 wrote to memory of 2648 2736 innqsrkjz.exe 33 PID 2736 wrote to memory of 2648 2736 innqsrkjz.exe 33 PID 2736 wrote to memory of 2648 2736 innqsrkjz.exe 33 PID 2648 wrote to memory of 2564 2648 inpsutmlb.exe 34 PID 2648 wrote to memory of 2564 2648 inpsutmlb.exe 34 PID 2648 wrote to memory of 2564 2648 inpsutmlb.exe 34 PID 2648 wrote to memory of 2564 2648 inpsutmlb.exe 34 PID 2648 wrote to memory of 2564 2648 inpsutmlb.exe 34 PID 2648 wrote to memory of 2564 2648 inpsutmlb.exe 34 PID 2648 wrote to memory of 2564 2648 inpsutmlb.exe 34 PID 2564 wrote to memory of 2516 2564 insvxwpco.exe 35 PID 2564 wrote to memory of 2516 2564 insvxwpco.exe 35 PID 2564 wrote to memory of 2516 2564 insvxwpco.exe 35 PID 2564 wrote to memory of 2516 2564 insvxwpco.exe 35 PID 2564 wrote to memory of 2516 2564 insvxwpco.exe 35 PID 2564 wrote to memory of 2516 2564 insvxwpco.exe 35 PID 2564 wrote to memory of 2516 2564 insvxwpco.exe 35 PID 2516 wrote to memory of 1976 2516 insezthji.exe 36 PID 2516 wrote to memory of 1976 2516 insezthji.exe 36 PID 2516 wrote to memory of 1976 2516 insezthji.exe 36 PID 2516 wrote to memory of 1976 2516 insezthji.exe 36 PID 2516 wrote to memory of 1976 2516 insezthji.exe 36 PID 2516 wrote to memory of 1976 2516 insezthji.exe 36 PID 2516 wrote to memory of 1976 2516 insezthji.exe 36 PID 1976 wrote to memory of 2212 1976 inyufnzuj.exe 37 PID 1976 wrote to memory of 2212 1976 inyufnzuj.exe 37 PID 1976 wrote to memory of 2212 1976 inyufnzuj.exe 37 PID 1976 wrote to memory of 2212 1976 inyufnzuj.exe 37 PID 1976 wrote to memory of 2212 1976 inyufnzuj.exe 37 PID 1976 wrote to memory of 2212 1976 inyufnzuj.exe 37 PID 1976 wrote to memory of 2212 1976 inyufnzuj.exe 37 PID 2212 wrote to memory of 2852 2212 inixpjqgj.exe 38 PID 2212 wrote to memory of 2852 2212 inixpjqgj.exe 38 PID 2212 wrote to memory of 2852 2212 inixpjqgj.exe 38 PID 2212 wrote to memory of 2852 2212 inixpjqgj.exe 38 PID 2212 wrote to memory of 2852 2212 inixpjqgj.exe 38 PID 2212 wrote to memory of 2852 2212 inixpjqgj.exe 38 PID 2212 wrote to memory of 2852 2212 inixpjqgj.exe 38 PID 2852 wrote to memory of 1848 2852 inyjbrycn.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55e87d644c383ee9fa9caf50cd9b738b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\System32\inbfyviuk.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\System32\injyqkarh.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\System32\innqsrkjz.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\System32\inpsutmlb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\System32\insvxwpco.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\System32\insezthji.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\System32\inyufnzuj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\System32\inixpjqgj.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\System32\inyjbrycn.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\System32\inmprqjiy.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\System32\inpleqlxa.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\System32\inmtnbdcu.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\System32\insohtodl.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\System32\inogwahsa.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\System32\inuqbjvqf.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\System32\inugvjlkd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\System32\incvyzsfr.exe18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\System32\ingvnhoze.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\System32\inwixlnmf.exe20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\System32\inxiaqxbm.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\System32\inykznpoh.exe22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\System32\indhxkwmb.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\System32\inlsmacbt.exe24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\System32\inqmfrmyb.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\System32\innfvgrkz.exe26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\System32\inoavpdfe.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\System32\invuwaxma.exe28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\System32\inaphxbit.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\System32\ineybxzdp.exe30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\System32\invrckwrg.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\System32\inbaqtkjr.exe32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\System32\inbuxzyre.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\System32\infumgnyd.exe34⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\System32\indwztgsi.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\System32\inwhpwale.exe36⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\System32\inxjymong.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\System32\ingvetxyk.exe38⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\System32\inkzrlbas.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\System32\inigtklnv.exe40⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\System32\inknedlyl.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\System32\inortslka.exe42⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\System32\inljyapnv.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\System32\inpbwqegf.exe44⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\System32\innlypqcs.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\System32\inrdysgih.exe46⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\System32\inwsdlxsh.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\System32\inetlfmxc.exe48⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\System32\inhegsgsd.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\System32\inzvgovkd.exe50⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\System32\ineuxonvv.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\System32\inkbaivic.exe52⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\System32\ingwzqpxx.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\System32\inldtepix.exe54⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\System32\injmdckxk.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\System32\injhulmow.exe56⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\System32\inixomukg.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\System32\inwmpgfnn.exe58⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\System32\intpaiupe.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\System32\inbmkzbqa.exe60⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\System32\indpalewk.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\System32\inomzqrdt.exe62⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Windows\SysWOW64\inrlmbbts.exeC:\Windows\System32\inrlmbbts.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\System32\inqgdzfrf.exe64⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\System32\ingerepgv.exe65⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\System32\infhthtec.exe66⤵PID:1684
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\System32\intcrvwiy.exe67⤵PID:2884
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\System32\infvypoww.exe68⤵PID:2920
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\System32\iniqzgcyz.exe69⤵PID:3004
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\System32\inilcbjwj.exe70⤵PID:2600
-
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\System32\inmeufqjy.exe71⤵PID:2664
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\System32\infgwnmcy.exe72⤵PID:2192
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\System32\injwnoaqy.exe73⤵PID:2996
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\System32\inlhzufqa.exe74⤵PID:2508
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\System32\inqtvunam.exe75⤵PID:2504
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\System32\inaivxrqr.exe76⤵PID:2328
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\System32\inazpsjiq.exe77⤵PID:2960
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\System32\inapnrseu.exe78⤵PID:2296
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\System32\inbohznex.exe79⤵PID:2836
-
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\System32\insbquvhx.exe80⤵PID:3008
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\System32\inpqffxwb.exe81⤵PID:2696
-
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\System32\infudswxj.exe82⤵PID:2488
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\System32\inrshhzyd.exe83⤵PID:1752
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\System32\injlxlxig.exe84⤵PID:2868
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\System32\inefvmlzb.exe85⤵
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\System32\intsuvkkg.exe86⤵PID:2780
-
C:\Windows\SysWOW64\inyteppma.exeC:\Windows\System32\inyteppma.exe87⤵PID:280
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\System32\inhiypoew.exe88⤵PID:1248
-
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\System32\inmkxopbr.exe89⤵PID:852
-
C:\Windows\SysWOW64\inowmiavg.exeC:\Windows\System32\inowmiavg.exe90⤵PID:2140
-
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\System32\inbjwysrs.exe91⤵PID:1748
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\System32\indskelwb.exe92⤵PID:1252
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\System32\inrcangym.exe93⤵PID:1340
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\System32\incraptug.exe94⤵PID:552
-
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\System32\invhwkmle.exe95⤵PID:1592
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\System32\inpiofygs.exe96⤵PID:1996
-
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\System32\inahuhbcs.exe97⤵PID:1232
-
C:\Windows\SysWOW64\inqrggyxc.exeC:\Windows\System32\inqrggyxc.exe98⤵PID:2196
-
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\System32\inupalliz.exe99⤵PID:1676
-
C:\Windows\SysWOW64\indeulkya.exeC:\Windows\System32\indeulkya.exe100⤵PID:2164
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\System32\indqsmlmh.exe101⤵PID:2472
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\System32\inhwnltjf.exe102⤵PID:2888
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\System32\inutvwllh.exe103⤵PID:3040
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\System32\inqnbrgit.exe104⤵PID:2760
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\System32\inxnqhgoo.exe105⤵PID:2920
-
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\System32\inmhxsddw.exe106⤵PID:2596
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\System32\inatwyxqd.exe107⤵PID:2720
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\System32\infdqdofu.exe108⤵PID:1476
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\System32\incsvmltt.exe109⤵PID:2968
-
C:\Windows\SysWOW64\infrfqjpo.exeC:\Windows\System32\infrfqjpo.exe110⤵PID:2076
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\System32\inhfsfaqh.exe111⤵PID:1432
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\System32\inhjvjvge.exe112⤵PID:2328
-
C:\Windows\SysWOW64\inzhpyfbx.exeC:\Windows\System32\inzhpyfbx.exe113⤵PID:2960
-
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\System32\inocymrvp.exe114⤵PID:2296
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\System32\ingvzmksi.exe115⤵PID:1508
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\System32\inxtleici.exe116⤵PID:3008
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\System32\inertnmni.exe117⤵PID:808
-
C:\Windows\SysWOW64\inqzfhsqg.exeC:\Windows\System32\inqzfhsqg.exe118⤵PID:2488
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\System32\inmibthrw.exe119⤵PID:1900
-
C:\Windows\SysWOW64\inzhuwqpq.exeC:\Windows\System32\inzhuwqpq.exe120⤵PID:680
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\System32\inqcxrfhg.exe121⤵PID:1272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-