Analysis
- max time kernel
24s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
General
- Target jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe
- Size 115KB
- Sample260919-te3beasgrc
- SHA256 d8dfec6cea84c701a9644052932238ad843e7e01592a1b8016f8f849f29ccb08
- MD5 9d8b1db25be853b2a2b72bfcaadc6dc6
- SHA1 61f3735a01ba62b02cdcf3b5d4bcd5842f84c58c
- SHA512 3922996665a6cd0f91b6f5cadfb78f5441eb50467491da4e5921a3bccc8d58112ec79cf593cde516edefa3336ef22bc72702337b0f738fd68c606eca170a1a98
- SSDEEP 3072:5QQNiykPP0a4ksrKNVWfc0TncC/l41GHGIx:5xiX8kZWlf
- TLSH T140C35C23F2D48872E1A21EB89C169664993BFE203D3C265BB7F85D0D5D7D28118AD3D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation system032.exe - Executes dropped EXE 64 IoCs
pid Process 4896 system032.exe 5016 system032.exe 984 system032.exe 3864 system032.exe 3328 system032.exe 5516 system032.exe 5508 system032.exe 5064 system032.exe 368 system032.exe 6092 system032.exe 4188 system032.exe 4652 system032.exe 2040 system032.exe 4608 system032.exe 1672 system032.exe 1840 system032.exe 5480 system032.exe 2324 system032.exe 6072 system032.exe 5896 system032.exe 5824 system032.exe 5892 system032.exe 1692 system032.exe 3424 system032.exe 2916 system032.exe 3660 system032.exe 2164 system032.exe 3708 system032.exe 4344 system032.exe 3800 system032.exe 748 system032.exe 5152 system032.exe 2396 system032.exe 2684 system032.exe 3984 system032.exe 5704 system032.exe 4560 system032.exe 4992 system032.exe 768 system032.exe 744 system032.exe 3520 system032.exe 5620 system032.exe 4184 system032.exe 3836 system032.exe 3172 system032.exe 4888 system032.exe 4332 system032.exe 564 system032.exe 5836 system032.exe 4352 system032.exe 1044 system032.exe 2644 system032.exe 4972 system032.exe 440 system032.exe 1904 system032.exe 5412 system032.exe 5400 system032.exe 1052 system032.exe 6084 system032.exe 4884 system032.exe 4008 system032.exe 5024 system032.exe 5296 system032.exe 2348 system032.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe File created C:\WINDOWS\SysWOW64\system032.exe system032.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system032.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4776 wrote to memory of 4896 4776 jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe 85 PID 4896 wrote to memory of 5016 4896 system032.exe 86 PID 5016 wrote to memory of 984 5016 system032.exe 87 PID 984 wrote to memory of 3864 984 system032.exe 89 PID 3864 wrote to memory of 3328 3864 system032.exe 91 PID 3328 wrote to memory of 5516 3328 system032.exe 92 PID 5516 wrote to memory of 5508 5516 system032.exe 94 PID 5508 wrote to memory of 5064 5508 system032.exe 95 PID 5064 wrote to memory of 368 5064 system032.exe 96 PID 368 wrote to memory of 6092 368 system032.exe 97 PID 6092 wrote to memory of 4188 6092 system032.exe 98 PID 4188 wrote to memory of 4652 4188 system032.exe 99 PID 4652 wrote to memory of 2040 4652 system032.exe 100 PID 2040 wrote to memory of 4608 2040 system032.exe 101 PID 4608 wrote to memory of 1672 4608 system032.exe 102 PID 1672 wrote to memory of 1840 1672 system032.exe 103 PID 1840 wrote to memory of 5480 1840 system032.exe 104 PID 5480 wrote to memory of 2324 5480 system032.exe 105 PID 2324 wrote to memory of 6072 2324 system032.exe 106 PID 6072 wrote to memory of 5896 6072 system032.exe 107 PID 5896 wrote to memory of 5824 5896 system032.exe 108 PID 5824 wrote to memory of 5892 5824 system032.exe 109 PID 5892 wrote to memory of 1692 5892 system032.exe 110 PID 1692 wrote to memory of 3424 1692 system032.exe 111 PID 3424 wrote to memory of 2916 3424 system032.exe 112 PID 2916 wrote to memory of 3660 2916 system032.exe 113 PID 3660 wrote to memory of 2164 3660 system032.exe 114 PID 2164 wrote to memory of 3708 2164 system032.exe 115 PID 3708 wrote to memory of 4344 3708 system032.exe 116 PID 4344 wrote to memory of 3800 4344 system032.exe 117 PID 3800 wrote to memory of 748 3800 system032.exe 118 PID 748 wrote to memory of 5152 748 system032.exe 119 PID 5152 wrote to memory of 2396 5152 system032.exe 120 PID 2396 wrote to memory of 2684 2396 system032.exe 121 PID 2684 wrote to memory of 3984 2684 system032.exe 122 PID 3984 wrote to memory of 5704 3984 system032.exe 123 PID 5704 wrote to memory of 4560 5704 system032.exe 124 PID 4560 wrote to memory of 4992 4560 system032.exe 125 PID 4992 wrote to memory of 768 4992 system032.exe 126 PID 768 wrote to memory of 744 768 system032.exe 127 PID 744 wrote to memory of 3520 744 system032.exe 128 PID 3520 wrote to memory of 5620 3520 system032.exe 129 PID 5620 wrote to memory of 4184 5620 system032.exe 130 PID 4184 wrote to memory of 3836 4184 system032.exe 131 PID 3836 wrote to memory of 3172 3836 system032.exe 132 PID 3172 wrote to memory of 4888 3172 system032.exe 133 PID 4888 wrote to memory of 4332 4888 system032.exe 134 PID 4332 wrote to memory of 564 4332 system032.exe 135 PID 564 wrote to memory of 5836 564 system032.exe 136 PID 5836 wrote to memory of 4352 5836 system032.exe 137 PID 4352 wrote to memory of 1044 4352 system032.exe 138 PID 1044 wrote to memory of 2644 1044 system032.exe 139 PID 2644 wrote to memory of 4972 2644 system032.exe 140 PID 4972 wrote to memory of 440 4972 system032.exe 141 PID 440 wrote to memory of 1904 440 system032.exe 142 PID 1904 wrote to memory of 5412 1904 system032.exe 143 PID 5412 wrote to memory of 5400 5412 system032.exe 144 PID 5400 wrote to memory of 1052 5400 system032.exe 145 PID 1052 wrote to memory of 6084 1052 system032.exe 146 PID 6084 wrote to memory of 4884 6084 system032.exe 147 PID 4884 wrote to memory of 4008 4884 system032.exe 148 PID 4008 wrote to memory of 5024 4008 system032.exe 149 PID 5024 wrote to memory of 5296 5024 system032.exe 150 PID 5296 wrote to memory of 2348 5296 system032.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9d8b1db25be853b2a2b72bfcaadc6dc6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"48⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"52⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2348 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"66⤵PID:4000
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"67⤵
- System Location Discovery: System Language Discovery
PID:2424 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"68⤵
- Checks computer location settings
- Drops file in System32 directory
PID:5536 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"69⤵
- Checks computer location settings
PID:5176 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"70⤵PID:996
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"71⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1208 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"72⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4056 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"73⤵
- System Location Discovery: System Language Discovery
PID:4004 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"74⤵PID:868
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"75⤵
- Drops file in System32 directory
PID:1912 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"76⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2356 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"77⤵PID:3264
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"78⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3056 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"79⤵
- Checks computer location settings
PID:4208 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"80⤵
- Checks computer location settings
- Drops file in System32 directory
PID:2740 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"81⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1696 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"82⤵
- Checks computer location settings
PID:208 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"83⤵PID:3948
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"84⤵PID:1740
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"85⤵
- System Location Discovery: System Language Discovery
PID:980 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"86⤵PID:5036
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"87⤵
- Drops file in System32 directory
PID:904 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"88⤵PID:628
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"89⤵
- Checks computer location settings
PID:5228 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"90⤵
- Drops file in System32 directory
PID:3372 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"91⤵PID:5364
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"92⤵
- System Location Discovery: System Language Discovery
PID:3788 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"93⤵
- System Location Discovery: System Language Discovery
PID:1160 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"94⤵PID:5348
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"95⤵
- Checks computer location settings
PID:1336 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"96⤵PID:2224
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"97⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1220 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"98⤵
- Checks computer location settings
PID:2880 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"99⤵
- Drops file in System32 directory
PID:2780 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"100⤵PID:5220
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"101⤵PID:3300
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"102⤵PID:5116
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"103⤵
- System Location Discovery: System Language Discovery
PID:4472 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"104⤵PID:2436
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"105⤵
- Drops file in System32 directory
PID:4020 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"106⤵PID:1748
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"107⤵PID:4440
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"108⤵PID:5912
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"109⤵PID:5376
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"110⤵PID:5020
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"111⤵
- Checks computer location settings
- Drops file in System32 directory
PID:3508 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"112⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"113⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5916 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"114⤵
- Drops file in System32 directory
PID:4200 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"115⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2416 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2272 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"117⤵
- Drops file in System32 directory
PID:4680 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"118⤵PID:3036
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"119⤵
- Checks computer location settings
PID:5436 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"120⤵PID:5936
-
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1240 -
C:\WINDOWS\SysWOW64\system032.exe"C:\WINDOWS\SYSTEM32\system032.exe"122⤵
- Drops file in System32 directory
PID:1836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-